CVE-2026-67610 OpenEMR 8.2.0 OAuth2 Dynamic Client Registration Unauthorized FHIR Access

OpenEMR through 8.2.0 contains an improper authentication vulnerability in the OAuth2 dynamic client registration endpoint that allows unauthenticated attackers to register a malicious client with system-level FHIR scopes by supplying a self-generated RSA keypair via the jwks field. Once an...

EUVD-2026-52347

OpenEMR through 8.2.0 contains an improper authentication vulnerability in the OAuth2 dynamic client registration endpoint that allows unauthenticated attackers to register a malicious client with system-level FHIR scopes by supplying a self-generated RSA keypair via the jwks field. Once an...

CVE-2026-67610 OpenEMR 8.2.0 OAuth2 Dynamic Client Registration Unauthorized FHIR Access

OpenEMR through 8.2.0 contains an improper authentication vulnerability in the OAuth2 dynamic client registration endpoint that allows unauthenticated attackers to register a malicious client with system-level FHIR scopes by supplying a self-generated RSA keypair via the jwks field. Once an...

CVE-2026-39932

CVE-2026-39932 affects OpenEMR 8.2.0, enabling remote code execution through the document category tree component. The vulnerability arises from an unsanitized eval() in CategoryTree (library/classes/Tree.class.php) that executes PHP payloads injected into the categories table. An authenticated a...

CVE-2026-39932 OpenEMR 8.2.0 Remote Code Execution via CategoryTree eval() Injection

OpenEMR through 8.2.0 contains a remote code execution vulnerability in the document category tree component library/classes/Tree.class.php that allows authenticated administrators to execute arbitrary operating system commands by injecting PHP payloads into the categories database table. Attacke...

EUVD-2026-52345

OpenEMR through 8.2.0 contains a remote code execution vulnerability in the document category tree component library/classes/Tree.class.php that allows authenticated administrators to execute arbitrary operating system commands by injecting PHP payloads into the categories database table. Attacke...

CVE-2026-39932 OpenEMR 8.2.0 Remote Code Execution via CategoryTree eval() Injection

OpenEMR through 8.2.0 contains a remote code execution vulnerability in the document category tree component library/classes/Tree.class.php that allows authenticated administrators to execute arbitrary operating system commands by injecting PHP payloads into the categories database table. Attacke...

CVE-2026-39932 OpenEMR 8.2.0 Remote Code Execution via CategoryTree eval() Injection

OpenEMR through 8.2.0 contains a remote code execution vulnerability in the document category tree component library/classes/Tree.class.php that allows authenticated administrators to execute arbitrary operating system commands by injecting PHP payloads into the categories database table. Attacke...

CVE-2026-39931 OpenEMR Authenticated SQL Injection via backup.php Import Feature

OpenEMR through 8.2.0 contains an authenticated SQL injection vulnerability in the backup configuration import feature that allows administrators with admin or super ACL privileges to execute arbitrary DDL and DML statements against the application database by uploading a crafted SQL file at the...

CVE-2026-39931 OpenEMR Authenticated SQL Injection via backup.php Import Feature

OpenEMR through 8.2.0 contains an authenticated SQL injection vulnerability in the backup configuration import feature that allows administrators with admin or super ACL privileges to execute arbitrary DDL and DML statements against the application database by uploading a crafted SQL file at the...

CVE-2026-39931

OpenEMR through 8.2.0 contains an authenticated SQL injection vulnerability in the backup configuration import feature that allows administrators with admin or super ACL privileges to execute arbitrary DDL and DML statements against the application database by uploading a crafted SQL file at the...

CVE-2026-39931 OpenEMR Authenticated SQL Injection via backup.php Import Feature

OpenEMR through 8.2.0 contains an authenticated SQL injection vulnerability in the backup configuration import feature that allows administrators with admin or super ACL privileges to execute arbitrary DDL and DML statements against the application database by uploading a crafted SQL file at the...

EUVD-2026-52342

OpenEMR through 8.2.0 contains an authenticated SQL injection vulnerability in the backup configuration import feature that allows administrators with admin or super ACL privileges to execute arbitrary DDL and DML statements against the application database by uploading a crafted SQL file at the...

CVE-2026-39931

OpenEMR

CVE-2026-46518

OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 8.0.0.1, a stored cross-site scripting vulnerability in the prescription CSS/HTML multi-print feature allows a patient portal user to execute arbitrary JavaScript in a...

CVE-2026-46518

OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 8.0.0.1, a stored cross-site scripting vulnerability in the prescription CSS/HTML multi-print feature allows a patient portal user to execute arbitrary JavaScript in a...

OpenEMR 跨站脚本漏洞

OpenEMR is a set of open-source medical management systems developed by the OpenEMR community. This system can be used for medical practice management, electronic medical records, prescription writing, and medical billing applications. Versions of OpenEMR prior to 8.0.0.1 contained a cross-site...

CVE-2026-46518 OpenEMR: Stored XSS in prescription CSS/HTML print view via patient demographics

OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 8.0.0.1, a stored cross-site scripting vulnerability in the prescription CSS/HTML multi-print feature allows a patient portal user to execute arbitrary JavaScript in a...

CVE-2026-46518 OpenEMR: Stored XSS in prescription CSS/HTML print view via patient demographics

OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 8.0.0.1, a stored cross-site scripting vulnerability in the prescription CSS/HTML multi-print feature allows a patient portal user to execute arbitrary JavaScript in a...

EUVD-2026-35869

OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 8.0.0.1, a stored cross-site scripting vulnerability in the prescription CSS/HTML multi-print feature allows a patient portal user to execute arbitrary JavaScript in a...