2 matches found
EUVD-2026-119553
OpenEMR before 8.3.0 contains an insecure direct object reference vulnerability in OnsitePortalActivityController::Update that checks the request's patientId instead of the stored record's owner. Authenticated portal patients can send PUT requests to the onsiteportalactivity API with another...
8.6CVSS5.8AI score0.00294EPSS
SaveExploits0References3
PT-2026-139963
OpenEMR before 8.3.0 contains an insecure direct object reference vulnerability in OnsitePortalActivityController::Update that checks the request's patientId instead of the stored record's owner. Authenticated portal patients can send PUT requests to the onsiteportalactivity API with another...
8.6CVSS5.9AI score0.00294EPSS
SaveExploits0References4
20