CVE-2018-17179

An issue was discovered in OpenEMR before 5.0.1 Patch 7. There is SQL Injection in the maketask function in /interface/forms/eyemag/php/taskmanfunctions.php via /interface/forms/eyemag/taskman.php...

CVE-2018-17179

An issue was discovered in OpenEMR before 5.0.1 Patch 7. There is SQL Injection in the maketask function in /interface/forms/eyemag/php/taskmanfunctions.php via /interface/forms/eyemag/taskman.php...

CVE-2018-17179

OpenEMR prior to 5.0.1 Patch 7 contains a SQL injection in the make_task function under /interface/forms/eye_mag/php/taskman_functions.php via /interface/forms/eye_mag/taskman.php. The issue affects OpenEMR 5.0.1 Patch 7 and earlier. Root cause is improper input handling enabling SQLi, with CVSS ...

PT-2019-6164

Name of the Vulnerable Software and Affected Versions OpenEMR versions prior to 5.0.1 Patch 7 Description The issue is related to the lack of validation of XML object sequences in the make task function of OpenEMR, which can be exploited by a remote attacker to conduct SQL injection attacks. The...

CVE-2018-17181: Improper Neutralization of Special Elements used in an SQL Command

An issue was discovered in OpenEMR before 5.0.1 Patch 7. SQL Injection exists in the SaveAudit function in /portal/lib/paylib.php and the portalAudit function in /portal/lib/appsql.class.php...

PT-2019-9405

Name of the Vulnerable Software and Affected Versions OpenEMR versions prior to 5.0.1 Patch 7 Description An issue exists where Directory Traversal is possible, allowing access to files outside the intended directory. This is achieved by manipulating the docid parameter with a value such as ../ i...

PT-2019-9406

Name of the Vulnerable Software and Affected Versions OpenEMR versions prior to 5.0.1 Patch 7 Description An issue exists in the software, where SQL Injection is present in the SaveAudit function in /portal/lib/paylib.php and the portalAudit function in /portal/lib/appsql.class.php. Recommendatio...

CVE-2018-17180: Improper Limitation of a Pathname to a Restricted Directory

An issue was discovered in OpenEMR before 5.0.1 Patch 7. Directory Traversal exists via docid=../ to /portal/lib/downloadtemplate.php...

CVE-2018-17179: Improper Neutralization of Special Elements used in an SQL Command

An issue was discovered in OpenEMR before 5.0.1 Patch 7. There is SQL Injection in the maketask function in /interface/forms/eyemag/php/taskmanfunctions.php via /interface/forms/eyemag/taskman.php...

OpenEMR 5.0.1 Patch 6 SQLi Dump

This module exploits a SQLi vulnerability found in OpenEMR version 5.0.1 Patch 6 and lower. The vulnerability allows the contents of the entire database with exception of log and task tables to be extracted. This module saves each table as a .csv file in your loot directory and has been tested wi...

OpenEMR < 5.0.1 Patch 6 XSS Vulnerability

A vulnerability in flashcanvas.swf in OpenEMR could allow an unauthenticated, remote attacker to conduct a cross-site scripting XSS attack on a targeted system. SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by th...

OpenEMR Cross-Site Scripting Vulnerability (CNVD-2019-14077)

OpenEMR is an open source medical management system from the OpenEMR community. The system can be used for medical practice management, electronic medical records, prescription writing and medical billing requests. A security vulnerability exists in the flashcanvas.swf file in versions of OpenEMR...

Cross site scripting

A vulnerability in flashcanvas.swf in OpenEMR before 5.0.1 Patch 6 could allow an unauthenticated, remote attacker to conduct a cross-site scripting XSS attack on a targeted system...

CVE-2018-18035

A vulnerability in flashcanvas.swf in OpenEMR before 5.0.1 Patch 6 could allow an unauthenticated, remote attacker to conduct a cross-site scripting XSS attack on a targeted system...

CVE-2018-18035

A vulnerability in flashcanvas.swf in OpenEMR before 5.0.1 Patch 6 could allow an unauthenticated, remote attacker to conduct a cross-site scripting XSS attack on a targeted system...

CVE-2018-18035

CVE-2018-18035 describes an unauthenticated, remote XSS in the OpenEMR flashcanvas.swf component. The affected software is OpenEMR prior to 5.0.1 Patch 6. The vulnerability arises from an XSS in flashcanvas.swf that could be exploited by an attacker targeting a system using OpenEMR with this vers...

CVE-2018-18035

A vulnerability in flashcanvas.swf in OpenEMR before 5.0.1 Patch 6 could allow an unauthenticated, remote attacker to conduct a cross-site scripting XSS attack on a targeted system...

CVE-2018-18035

A vulnerability in flashcanvas.swf in OpenEMR before 5.0.1 Patch 6 could allow an unauthenticated, remote attacker to conduct a cross-site scripting XSS attack on a targeted system...

PT-2019-9548

Name of the Vulnerable Software and Affected Versions OpenEMR versions prior to 5.0.1 Patch 6 Description A cross-site scripting XSS issue exists, allowing an unauthenticated, remote attacker to conduct an attack on a targeted system. Recommendations For versions prior to 5.0.1 Patch 6, update to...

CVE-2018-18035: Improper Neutralization of Input During Web Page Generation

A vulnerability in flashcanvas.swf in OpenEMR before 5.0.1 Patch 6 could allow an unauthenticated, remote attacker to conduct a cross-site scripting XSS attack on a targeted system...