2694 matches found
OpenEMR code-related vulnerabilities
OpenEMR is an open source medical management system from the OpenEMR community. The system can be used for medical practice management, electronic medical records, prescription writing and medical billing requests. A code issue vulnerability exists in versions prior to OpenEMR 7.0.0.2 that stems...
OpenEMR Access Control Vulnerability
OpenEMR is an open source medical management system from the OpenEMR community. The system can be used for medical practice management, electronic medical records, prescription writing, and medical billing requests. An Access Control Error vulnerability exists in versions of OpenEMR prior to...
OpenEMR input validation error vulnerability
OpenEMR is an open source medical management system from the OpenEMR community. The system can be used for medical practice management, electronic medical records, prescription writing, and medical billing requests. An input validation error vulnerability exists in versions of OpenEMR prior to...
CVE-2022-4503: Improper Neutralization of Input During Web Page Generation
Cross-site Scripting XSS - Generic in GitHub repository openemr/openemr prior to 7.0.0.2...
CVE-2022-4506: Unrestricted Upload of File with Dangerous Type
Unrestricted Upload of File with Dangerous Type in GitHub repository openemr/openemr prior to 7.0.0.2...
CVE-2022-4504 Improper Input Validation in openemr/openemr
Improper Input Validation in GitHub repository openemr/openemr prior to 7.0.0.2...
CVE-2022-4504: Improper Input Validation
Improper Input Validation in GitHub repository openemr/openemr prior to 7.0.0.2...
CVE-2022-4506 Unrestricted Upload of File with Dangerous Type in openemr/openemr
Unrestricted Upload of File with Dangerous Type in GitHub repository openemr/openemr prior to 7.0.0.2...
OpenEMR Cross-Site Scripting (CVE-2022-1178)
A stored cross-site scripting vulnerability exists in OpenEMR. The vulnerability is due to insufficient sanitization of user input...
OpenEMR Cross-Site Scripting (CVE-2022-1179)
A stored cross-site scripting vulnerability exists for OpenEMR. This vulnerability is due to improper input validation for the fldtitle parameter when creating rules...
OpenEMR Cross-Site Scripting (CVE-2022-1181)
A cross-site scripting vulnerability exists in OpenEMR. The vulnerability is due to insufficient sanitization of patients' first and last names in newcomprehensivesave.php...
Stored XSS
Description openemr has a feature to customize the "Text in the login box " , due to a bad sanitization it allows to put some html tag like "form" scheme which allows to execute javascript code. 1. login as user glpi/glpi admin user 2. go to HOME-SETUP-GENERAL...
Multiple Authenticated Remote Code Execution Vulnerabilities in Admin Panel
Description An attacker with administrative privileges in the openEMR application can execute arbitrary code on the server remote code execution RCE. This was tested in openEMR version 7.0.0 1 but also affects previous versions of openEMR. Proof of Concept First of all, start a netcat listener on...
WS-2022-0452
Multiple Authenticated Remote Code Execution Vulnerabilities in Admin Panel in openemr/openemr. An attacker with administrative privileges in the openEMR application can execute arbitrary code on the server remote code execution RCE. This was tested in openEMR version 7.0.0 1 but also affects...
Stored XSS
Description openemr has a feature to customize the "User Manual Link Override" , due to a bad sanitization it allows to put javascript:// scheme which allows to execute javascript code. Proof of Concept 1. login with admin 2. go on Global Settings - Branding 3. Edit User Manual Link Override Fiel...
Cross Site Scripting (reflected) on fee_sheet_ajax.php
Description When testing the app for XSS we found out that the feesheetajax.php endpoint is actually vulnerable to an XSS exploit. PoC 1. visit https:///interface/forms/feesheet/review/feesheetajax.php?task=retrieve&mode=encounters&prevencounter=%3Cimg%20src%3da%20onerror%3dalertdocument.cookie%3...
CVE-2022-2824
Authorization Bypass Through User-Controlled Key in GitHub repository openemr/openemr prior to 7.0.0.1...
CVE-2022-2824
Authorization Bypass Through User-Controlled Key in GitHub repository openemr/openemr prior to 7.0.0.1...
