OpenEMR Directory Traversal Vulnerability (CNVD-2019-28405)

OpenEMR is a medical practice management software that also supports electronic medical records EMR. A directory traversal vulnerability in the patient file download interface in OpenEMR 5.0.1 and earlier versions can be exploited by an authenticated attacker to download arbitrary files from the...

OpenEMR Command Injection Vulnerability (CNVD-2019-28410)

OpenEMR is a medical practice management software that also supports electronic medical records EMR. A command injection vulnerability exists in OpenEMR 5.0.1 and earlier versions, which can be exploited by an authenticated attacker to execute arbitrary commands on the host system via the "Scanne...

OpenEMR Cross-Site Scripting Vulnerability (CNVD-2019-28409)

OpenEMR is a medical practice management software that also supports electronic medical records EMR. A cross-site scripting vulnerability in the patientid parameter in controller.php in OpenEMR 5.0.1 and earlier versions can be exploited by an attacker to execute arbitrary code in the context of ...

CVE-2019-3968

In OpenEMR 5.0.1 and earlier, an authenticated attacker can execute arbitrary commands on the host system via the Scanned Forms interface when creating a new form...

CVE-2019-3968

In OpenEMR 5.0.1 and earlier, an authenticated attacker can execute arbitrary commands on the host system via the Scanned Forms interface when creating a new form...

Command injection

In OpenEMR 5.0.1 and earlier, an authenticated attacker can execute arbitrary commands on the host system via the Scanned Forms interface when creating a new form...

CVE-2019-3967

In OpenEMR 5.0.1 and earlier, the patient file download interface contains a directory traversal flaw that allows authenticated attackers to download arbitrary files from the host system...

CVE-2019-3967

In OpenEMR 5.0.1 and earlier, the patient file download interface contains a directory traversal flaw that allows authenticated attackers to download arbitrary files from the host system...

CVE-2019-3965

In OpenEMR 5.0.1 and earlier, controller.php contains a reflected XSS vulnerability in the documentid parameter. This could allow an attacker to execute arbitrary code in the context of a user's session...

CVE-2019-3963

In OpenEMR 5.0.1 and earlier, controller.php contains a reflected XSS vulnerability in the patientid parameter. This could allow an attacker to execute arbitrary code in the context of a user's session...

CVE-2019-3966

In OpenEMR 5.0.1 and earlier, controller.php contains a reflected XSS vulnerability in the foreignid parameter. This could allow an attacker to execute arbitrary code in the context of a user's session...

CVE-2019-3965

In OpenEMR 5.0.1 and earlier, controller.php contains a reflected XSS vulnerability in the documentid parameter. This could allow an attacker to execute arbitrary code in the context of a user's session...

CVE-2019-3963

In OpenEMR 5.0.1 and earlier, controller.php contains a reflected XSS vulnerability in the patientid parameter. This could allow an attacker to execute arbitrary code in the context of a user's session...

CVE-2019-3964

In OpenEMR 5.0.1 and earlier, controller.php contains a reflected XSS vulnerability in the docid parameter. This could allow an attacker to execute arbitrary code in the context of a user's session...

CVE-2019-3966

In OpenEMR 5.0.1 and earlier, controller.php contains a reflected XSS vulnerability in the foreignid parameter. This could allow an attacker to execute arbitrary code in the context of a user's session...

CVE-2019-3964

In OpenEMR 5.0.1 and earlier, controller.php contains a reflected XSS vulnerability in the docid parameter. This could allow an attacker to execute arbitrary code in the context of a user's session...

Cross site scripting

In OpenEMR 5.0.1 and earlier, controller.php contains a reflected XSS vulnerability in the foreignid parameter. This could allow an attacker to execute arbitrary code in the context of a user's session...

Directory traversal

In OpenEMR 5.0.1 and earlier, the patient file download interface contains a directory traversal flaw that allows authenticated attackers to download arbitrary files from the host system...

Cross site scripting

In OpenEMR 5.0.1 and earlier, controller.php contains a reflected XSS vulnerability in the documentid parameter. This could allow an attacker to execute arbitrary code in the context of a user's session...

Cross site scripting

In OpenEMR 5.0.1 and earlier, controller.php contains a reflected XSS vulnerability in the docid parameter. This could allow an attacker to execute arbitrary code in the context of a user's session...