The vulnerability of the phpgacl/acl_admin.tpl template in the PHP library for managing access in web applications. This is part of the phpGACL system used for managing medical documentation in OpenEMR. It allows attackers to perform cross-site scripting attacks.

The vulnerability of the phpgacl/acladmin.tpl PHP template used in the phpGACL access control library for web applications in the OpenEMR medical documentation system is related to the lack of protection for the website structure when processing the aclid template parameter. Exploiting this...

The vulnerability of the phpgacl/assign_group.tpl template in the PHP library for managing access in web applications of the phpGACL system for managing medical documentation in OpenEMR, allowing attackers to perform cross-site scripting attacks.

The vulnerability of the phpgacl/assigngroup.tpl template in the PHP library for managing access in web applications is related to the lack of protective measures taken when processing the groupid template parameter. Exploiting this vulnerability allows a malicious actor to perform cross-site...

CVE-2022-1178

Stored Cross Site Scripting in GitHub repository openemr/openemr prior to 6.0.0.4...

CVE-2022-1459

Non-Privilege User Can View Patient’s Disclosures in GitHub repository openemr/openemr prior to 6.1.0.1...

CVE-2022-1181

Stored Cross Site Scripting in GitHub repository openemr/openemr prior to 6.0.0.2...

CVE-2022-1461

Non Privilege User can Enable or Disable Registered in GitHub repository openemr/openemr prior to 6.1.0.1...

CVE-2022-1458

Stored XSS Leads To Session Hijacking in GitHub repository openemr/openemr prior to 6.1.0.1...

CVE-2022-2733

Cross-site Scripting XSS - Reflected in GitHub repository openemr/openemr prior to 7.0.0.1...

CVE-2022-2824

Authorization Bypass Through User-Controlled Key in GitHub repository openemr/openemr prior to 7.0.0.1...

CVE-2022-2734

Improper Restriction of Rendered UI Layers or Frames in GitHub repository openemr/openemr prior to 7.0.0.1...

CVE-2022-2732

Missing Authorization in GitHub repository openemr/openemr prior to 7.0.0.1...

CVE-2022-2493

Data Access from Outside Expected Data Manager Component in GitHub repository openemr/openemr prior to 7.0.0...

CVE-2022-4504

Improper Input Validation in GitHub repository openemr/openemr prior to 7.0.0.2...

CVE-2022-4506

Unrestricted Upload of File with Dangerous Type in GitHub repository openemr/openemr prior to 7.0.0.2...

CVE-2022-4502

Cross-site Scripting XSS - Reflected in GitHub repository openemr/openemr prior to 7.0.0.2...

CVE-2022-4615

Cross-site Scripting XSS - Reflected in GitHub repository openemr/openemr prior to 7.0.0.2...

CVE-2022-4567

Improper Access Control in GitHub repository openemr/openemr prior to 7.0.0.2...

CVE-2022-4505

Authorization Bypass Through User-Controlled Key in GitHub repository openemr/openemr prior to 7.0.0.2...

CVE-2020-13569

A cross-site request forgery vulnerability exists in the GACL functionality of OpenEMR 5.0.2 and development version 6.0.0 commit babec93f600ff1394f91ccd512bcad85832eb6ce. A specially crafted HTTP request can lead to the execution of arbitrary requests in the context of the victim. An attacker ca...

CVE-2024-0875

A stored cross-site scripting XSS vulnerability exists in openemr/openemr version 7.0.1. An attacker can inject malicious payloads into the 'inputBody' field in the Secure Messaging feature, which can then be sent to other users. When the recipient views the malicious message, the payload is...