OpenEMR < 7.0.1 - Cross-site Scripting

Cross-site Scripting XSS - Reflected in GitHub repository openemr/openemr prior to 7.0.1. id: CVE-2023-2949 info: name: OpenEMR 7.0.1 - Cross-site Scripting author: ritikchaddha,princechaddha severity: medium description: | Cross-site Scripting XSS - Reflected in GitHub repository openemr/openemr...

CVE-2026-25930

OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 8.0.0, the Layout-Based Form LBF printable view accepts formid and visitid or patientid from the request and does not verify that the form belongs to the current user’s...

CVE-2024-26476

An issue in open-emr before v.7.0.2 allows a remote attacker to escalate privileges via a crafted script to the formid parameter in the ereqform.php component...

CVE-2024-26476

An issue in open-emr before v.7.0.2 allows a remote attacker to escalate privileges via a crafted script to the formid parameter in the ereqform.php component...

Design/Logic Flaw

An issue in open-emr before v.7.0.2 allows a remote attacker to escalate privileges via a crafted script to the formid parameter in the ereqform.php component...

CVE-2024-26476

OpenEMR prior to 7.0.2 is affected by CVE-2024-26476. A remote attacker can escalate privileges by sending a crafted script to the formid parameter in ereq_form.php. The Red Hat and OSV entries confirm the same issue in OpenEMR’s ereq_form.php formid handling, implying a privilege escalation vuln...

PT-2024-21396 · Openemr · Openemr

Name of the Vulnerable Software and Affected Versions: open-emr versions prior to 7.0.2 Description: An issue in open-emr allows a remote attacker to escalate privileges via a crafted script to the formid parameter in the ereq form.php component. Recommendations: For versions prior to 7.0.2, upda...

CVE-2024-26476

An issue in open-emr before v.7.0.2 allows a remote attacker to escalate privileges via a crafted script to the formid parameter in the ereqform.php component...

CVE-2024-26476

An issue in open-emr before v.7.0.2 allows a remote attacker to escalate privileges via a crafted script to the formid parameter in the ereqform.php component...

Open EMR 4.0 SQL Injection

Exploit Title: Open EMR Google Dork: inurl:"/interface/login/loginframe.php" intitle:"Login" intext:"Username:" Date: 3 / 08 / 2011 . Author: Mehdi Boukazoula ; Houssam Sahli . Software Link with patch : http://www.oemr.org/wiki/OpenEMRDownloads Version: v 4.0 full patched Tested on: v 4.0...