Command injection

OS command injection occurring in versions of OpenEMR before 5.0.1.4 allows a remote authenticated attacker to execute arbitrary commands by making a crafted request to interface/fax/faxdispatch.php after modifying the "hylafaxenscript" global variable in interface/super/editglobals.php...

Authentication flaw

Authentication bypass vulnerability in portal/account/register.php in versions of OpenEMR before 5.0.1.4 allows a remote attacker to access 1 portal/addediteventuser.php, 2 portal/findapptpopupuser.php, 3 portal/getallergies.php, 4 portal/getamendments.php, 5 portal/getlabresults.php, 6...

Sql injection

SQL injection vulnerability in interface/formsadmin/formsadmin.php from library/registry.inc in versions of OpenEMR before 5.0.1.4 allows a remote authenticated attacker to execute arbitrary SQL commands via the 'id' parameter...

Command injection

OS command injection occurring in versions of OpenEMR before 5.0.1.4 allows a remote authenticated attacker to execute arbitrary commands by making a crafted request to interface/main/daemonframe.php after modifying the "hylafaxserver" global variable in interface/super/editglobals.php...

Sql injection

SQL injection vulnerability in interface/patientfile/encounter/searchcode.php in versions of OpenEMR before 5.0.1.4 allows a remote authenticated attacker to execute arbitrary SQL commands via the 'text' parameter...

Sql injection

SQL injection vulnerability in interface/deidentificationforms/findcodepopup.php in versions of OpenEMR before 5.0.1.4 allows a remote authenticated attacker to execute arbitrary SQL commands via the 'searchterm' parameter...

CVE-2018-15146

SQL injection vulnerability in interface/deidentificationforms/findimmunizationpopup.php in versions of OpenEMR before 5.0.1.4 allows a remote authenticated attacker to execute arbitrary SQL commands via the 'searchterm' parameter...

Sql injection

SQL injection vulnerability in interface/forms/eyemag/php/Anythingsimple.php from library/forms.inc in versions of OpenEMR before 5.0.1.4 allows a remote authenticated attacker to execute arbitrary SQL commands via the 'encounter' parameter...

Command injection

OS command injection occurring in versions of OpenEMR before 5.0.1.4 allows a remote authenticated attacker to execute arbitrary commands by making a crafted request to interface/billing/sleobsearch.php after modifying the "printcommand" global variable in interface/super/editglobals.php...

CVE-2018-15146

SQL injection vulnerability in interface/deidentificationforms/findimmunizationpopup.php in versions of OpenEMR before 5.0.1.4 allows a remote authenticated attacker to execute arbitrary SQL commands via the 'searchterm' parameter...

CVE-2018-15151

SQL injection vulnerability in interface/deidentificationforms/findcodepopup.php in versions of OpenEMR before 5.0.1.4 allows a remote authenticated attacker to execute arbitrary SQL commands via the 'searchterm' parameter...

CVE-2018-15146

SQL injection vulnerability in interface/deidentificationforms/findimmunizationpopup.php in versions of OpenEMR before 5.0.1.4 allows a remote authenticated attacker to execute arbitrary SQL commands via the 'searchterm' parameter...

CVE-2018-15150

SQL injection vulnerability in interface/deidentificationforms/deidentificationscreen2.php in versions of OpenEMR before 5.0.1.4 allows a remote authenticated attacker to execute arbitrary SQL commands via the 'temporaryfilesdir' variable in interface/super/editglobals.php...

CVE-2018-15151

SQL injection vulnerability in interface/deidentificationforms/findcodepopup.php in versions of OpenEMR before 5.0.1.4 allows a remote authenticated attacker to execute arbitrary SQL commands via the 'searchterm' parameter...

CVE-2018-15153

OS command injection occurring in versions of OpenEMR before 5.0.1.4 allows a remote authenticated attacker to execute arbitrary commands by making a crafted request to interface/main/daemonframe.php after modifying the "hylafaxserver" global variable in interface/super/editglobals.php...

CVE-2018-15154

OS command injection occurring in versions of OpenEMR before 5.0.1.4 allows a remote authenticated attacker to execute arbitrary commands by making a crafted request to interface/billing/sleobsearch.php after modifying the "printcommand" global variable in interface/super/editglobals.php...

CVE-2018-15154

OpenEMR versions prior to 5.0.1.4 are affected by an OS command injection vulnerability. An authenticated remote attacker can craft a request to interface/billing/sl_eob_search.php after modifying the print_command global in interface/super/edit_globals.php to execute arbitrary commands. The issu...

CVE-2018-15146

OpenEMR is affected by a SQL injection in interface/de_identification_forms/find_immunization_popup.php for versions prior to 5.0.1.4. The vulnerability allows a remote authenticated attacker to execute arbitrary SQL commands through the 'search_term' parameter. Root cause: unsanitized input in t...

CVE-2018-15155

OS command injection occurring in versions of OpenEMR before 5.0.1.4 allows a remote authenticated attacker to execute arbitrary commands by making a crafted request to interface/fax/faxdispatch.php after modifying the "hylafaxenscript" global variable in interface/super/editglobals.php...

CVE-2018-15153

OpenEMR is affected by an OS command-injection vulnerability in versions before 5.0.1.4. The issue arises when a remote authenticated attacker crafts a request to interface/main/daemon_frame.php after modifying the hylafax_server global variable in interface/super/edit_globals.php. The root cause...