CVE-2026-124450

CVE-2026-124450 OpenEMR before 8.3.0 Arbitrary File Read/Write via disposeDocument 🧬 Overview A broken-access-control and path-traversal vulnerability exists in the oe-module-faxsms module bundled with OpenEMR versions prior to 8.3.0. The disposeDocument method in both RCFaxClient and...

VulnCheck KEV: CVE-2026-124490

OpenEMR before 8.3.0 contains a path traversal vulnerability in the RingCentral RCFaxClient disposeDocument method of oe-module-faxsms that allows authenticated attackers to read and write arbitrary files via the filepath parameter. Attackers can use action=download to read credentials and source...

CVE-2026-124456

OpenEMR before 8.3.0 contains missing authorization and insecure direct object reference vulnerabilities in the oe-module-prior-authorizations module that allow authenticated low-privilege users to access and modify other patients' records. Attackers can request public/reports/listreport.php to...

CVE-2026-124490 OpenEMR before 8.3.0 Arbitrary File Read/Write via oe-module-faxsms disposeDocument

OpenEMR before 8.3.0 contains a path traversal vulnerability in the RingCentral RCFaxClient disposeDocument method of oe-module-faxsms that allows authenticated attackers to read and write arbitrary files via the filepath parameter. Attackers can use action=download to read credentials and source...

CVE-2026-124490 OpenEMR before 8.3.0 Arbitrary File Read/Write via oe-module-faxsms disposeDocument

OpenEMR before 8.3.0 contains a path traversal vulnerability in the RingCentral RCFaxClient disposeDocument method of oe-module-faxsms that allows authenticated attackers to read and write arbitrary files via the filepath parameter. Attackers can use action=download to read credentials and source...

CVE-2026-124490 OpenEMR before 8.3.0 Arbitrary File Read/Write via oe-module-faxsms disposeDocument

OpenEMR before 8.3.0 contains a path traversal vulnerability in the RingCentral RCFaxClient disposeDocument method of oe-module-faxsms that allows authenticated attackers to read and write arbitrary files via the filepath parameter. Attackers can use action=download to read credentials and source...

EUVD-2026-119545

OpenEMR before 8.3.0 contains a path traversal vulnerability in the RingCentral RCFaxClient disposeDocument method of oe-module-faxsms that allows authenticated attackers to read and write arbitrary files via the filepath parameter. Attackers can use action=download to read credentials and source...

CVE-2026-124490

OpenEMR versions before 8.3.0 are vulnerable to a path traversal flaw within the RingCentral RCFaxClient disposeDocument() method of the oe-module-faxsms component. This vulnerability allows authenticated attackers to perform arbitrary file read and write operations via the file_path parameter. S...

EUVD-2026-119513

OpenEMR before 8.3.0 contains missing authorization and insecure direct object reference vulnerabilities in the oe-module-prior-authorizations module that allow authenticated low-privilege users to access and modify other patients' records. Attackers can request public/reports/listreport.php to...

CVE-2026-124456 OpenEMR before 8.3.0 Missing Authorization and IDOR in Prior-Authorizations Module

OpenEMR before 8.3.0 contains missing authorization and insecure direct object reference vulnerabilities in the oe-module-prior-authorizations module that allow authenticated low-privilege users to access and modify other patients' records. Attackers can request public/reports/listreport.php to...

CVE-2026-124456

OpenEMR versions before 8.3.0 are vulnerable to missing authorization and insecure direct object reference (IDOR) flaws within the oe-module-prior-authorizations module. These vulnerabilities allow authenticated low-privilege users to interact with other patients' records. Specifically, attackers...

CVE-2026-124456

OpenEMR before 8.3.0 contains missing authorization and insecure direct object reference vulnerabilities in the oe-module-prior-authorizations module that allow authenticated low-privilege users to access and modify other patients' records. Attackers can request public/reports/listreport.php to...

CVE-2026-124456 OpenEMR before 8.3.0 Missing Authorization and IDOR in Prior-Authorizations Module

OpenEMR before 8.3.0 contains missing authorization and insecure direct object reference vulnerabilities in the oe-module-prior-authorizations module that allow authenticated low-privilege users to access and modify other patients' records. Attackers can request public/reports/listreport.php to...

CVE-2026-124456 OpenEMR before 8.3.0 Missing Authorization and IDOR in Prior-Authorizations Module

OpenEMR before 8.3.0 contains missing authorization and insecure direct object reference vulnerabilities in the oe-module-prior-authorizations module that allow authenticated low-privilege users to access and modify other patients' records. Attackers can request public/reports/listreport.php to...

PT-2026-139971

OpenEMR before 8.3.0 contains missing authorization and insecure direct object reference vulnerabilities in the oe-module-prior-authorizations module that allow authenticated low-privilege users to access and modify other patients' records. Attackers can request public/reports/list report.php to...

CVE-2026-124456: openemr: OpenEMR before 8.3.0 contains missing authorization and insecure direct object reference vulnerabilities in the…

OpenEMR before 8.3.0 contains missing authorization and insecure direct object reference vulnerabilities in the oe-module-prior-authorizations module that allow authenticated low-privilege users to access and modify other patients' records. Attackers can request public/reports/listreport.php to...

PT-2026-140003

OpenEMR before 8.3.0 contains a path traversal vulnerability in the RingCentral RCFaxClient disposeDocument method of oe-module-faxsms that allows authenticated attackers to read and write arbitrary files via the file path parameter. Attackers can use action=download to read credentials and sourc...

CVE-2026-124490: openemr: OpenEMR before 8.3.0 contains a path traversal vulnerability in the RingCentral RCFaxClient disposeDocument() method of…

OpenEMR before 8.3.0 contains a path traversal vulnerability in the RingCentral RCFaxClient disposeDocument method of oe-module-faxsms that allows authenticated attackers to read and write arbitrary files via the filepath parameter. Attackers can use action=download to read credentials and source...

Malicious code in @zalastax/nolb-oe (npm)

The package @zalastax/nolb-oe was found to contain malicious code. --- Credit: OpenSSF source...

Malicious code in oe-extract-ids (PyPI)

Source: kam193 bebbe22a538c4b7b6688bd82facdd749052e801663cf523c8d9c1eb11f81ea57 Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTEST - Packages looking like typical pentest packages, but al...