CVE-2022-40471

CVE-2022-40471 通过无限制文件上传漏洞在Clinic's Patient Management System v 1.0中实现远程代码执行 技术描述: Clinic's Patient Management System v 1.0 中的远程代码执行漏洞允许攻击者通过 users.php 中的个人资料图片上传功能上传任意 php 网页后门webshell 受影响组件 - 源代码...

Hospital Management System 1.0 - Cross-Site Scripting

Hospital Management System 1.0 contains a cross-site scripting vulnerability via the searchdata parameter in doctor/search.php and patient-search.php. id: CVE-2021-39411 info: name: Hospital Management System 1.0 - Cross-Site Scripting author: arafatansari severity: high description: | Hospital...

CVE-2021-38149

CVE-2021-38149 Chikitsa Patient Management System 2.0.0 存储型跨站脚本（XSS） 在 Chikitsa Patient Management System 2.0.0 版本的多个页面中存在一个存储型跨站脚本（XSS）实例，该漏洞允许在用户浏览器中执行任意 JavaScript，从而可能使用户提升权限。 受影响页面： /index.php/admin/adduser /index.php/appointment/todos...

CVE-2021-40375

CVE-2021-40375 - OpenEyes 3.5.1 中的失效的访问控制 描述 在由 Apperta Foundation 开发的 OpenEyes 3.5.1 中发现了一个不当的访问控制漏洞。 低权限用户可以在其浏览器中加载患者档案，并在未具备所需权限级别的情况下访问敏感信息。尽管应用程序在网页上返回了“Forbidden”（禁止访问）消息，但服务器响应仍返回了关于该患者的全部信息。这些信息可以通过拦截代理查看，或者直接在浏览器中查看页面源代码来获取。 复现步骤 1. 以高权限用户身份查看患者档案。 2. 复制该患者档案的 URL。 3. 退出 OpenEyes 会话。 4...

CVE-2026-33910_SqlInjectionVulnerabilityOpenEMR8.0.0.2

CVE-2026-33910 - OpenEMR 弱点 CWE-89 对用于 SQL 命令的特殊元素的中和不当（'SQL 注入'） 该产品使用来自上游组件的外部影响输入来构造 SQL 命令的全部或部分，但未能正确中和或错误地中和那些可能修改预期 SQL 命令的特殊元素。如果没有充分去除或引用用户可控输入中的 SQL 语法，生成的 SQL 查询可能会导致这些输入被解释为 SQL 而非普通用户数据。更多信息请参考 MITRE。 总结 OpenEMR 8.0.0.2 在患者选择功能中存在一个 SQL 注入漏洞，可被已认证的攻击者利用。该漏洞源于患者选择功能中对输入验证不足。 详情...

exploits

exploits Published PoCs can be found at exploitdb.com Patient Appointment Scheduler System v1.0: Inbit Messenger v4.6.0:...

CVE-2021-40374

CVE-2021-40374 - OpenEyes 3.5.1 中的存储型跨站脚本（Stored Cross-site Scripting） 描述 在由 Apperta Foundation 开发的 OpenEyes 3.5.1 中发现了一个存储型跨站脚本（XSS）漏洞。 'Address1' 参数中的输入处理不当，导致 JavaScript 可以被注入到患者档案中。当 Web 浏览器加载患者档案时，JavaScript 就会执行。这可能被用来对查看患者档案的不知情用户发动 XSS 攻击。 复现步骤 1. 浏览到某个患者档案。 2. 点击屏幕顶部附近的 '编辑图标'。 3. 在...

CVE-2022-22296

CVE-2022-22296 Todos los detalles sobre CVE-2022-22296 Software: Sistema de Gestión de Registros de Pacientes de Hospital 1.0 Enlace del software: https://www.sourcecodester.com/php/15116/hospitals-patient-records-management-system-php-free-source-code.html Tipo de vulnerabilidad: Permisos...

CVE-2026-86301

A vulnerability has been found in code-projects Hospital Information System 1.0. Affected is an unknown function of the file /HIS/src/patients/editPatient.php of the component Patient Management. Such manipulation of the argument ID leads to cross site scripting. The attack may be launched...

CVE-2026-86301

CVE-2026-86301 is a reflected Cross-Site Scripting (XSS) vulnerability in code-projects Hospital Information System 1.0 , specifically in the Patient Management component at the file /HIS/src/patients/editPatient.php. The vulnerability is triggered by manipulation of the ID argument, allowing a r...

EUVD-2026-72353

A vulnerability has been found in code-projects Hospital Information System 1.0. Affected is an unknown function of the file /HIS/src/patients/editPatient.php of the component Patient Management. Such manipulation of the argument ID leads to cross site scripting. The attack may be launched...

CVE-2026-86301 code-projects Hospital Information System Patient Management editPatient.php cross site scripting

A vulnerability has been found in code-projects Hospital Information System 1.0. Affected is an unknown function of the file /HIS/src/patients/editPatient.php of the component Patient Management. Such manipulation of the argument ID leads to cross site scripting. The attack may be launched...

PT-2026-86686

A vulnerability has been found in code-projects Hospital Information System 1.0. Affected is an unknown function of the file /HIS/src/patients/editPatient.php of the component Patient Management. Such manipulation of the argument ID leads to cross site scripting. The attack may be launched...

EUVD-2026-68992

The KiviCare WordPress plugin before 4.5.5 does not perform authorization checks on some of its REST endpoints, allowing unauthenticated attackers to disclose the patient roster and, when a payment gateway is configured, the payment gateway secret key...

CVE-2026-13611

The KiviCare WordPress plugin (a Clinic & Patient Management System / EHR) prior to version 4.5.5 is missing authorization checks on certain REST endpoints , enabling unauthenticated attackers to disclose the patient roster and, when a payment gateway is configured, the payment gateway secret key...

CVE-2026-40508

OpenEMR before 8.3.0 contains a stored cross-site scripting vulnerability in the patient portal template import handler that allows authenticated attackers with Forms Administration permissions to upload template files containing arbitrary HTML or JavaScript. Attackers can inject malicious script...

CVE-2026-40507

OpenEMR before 8.3.0 contains a reflected cross-site scripting vulnerability in the patient portal template import handler. The templateHtml GET parameter is reflected into the page response without sanitization. An attacker can craft a URL that executes arbitrary JavaScript in the browser of any...

CVE-2026-40508

OpenEMR before 8.3.0 is affected by a stored cross-site scripting (XSS) vulnerability in the patient portal template import handler . The root cause is the lack of sanitization on uploaded template files: authenticated attackers holding Forms Administration permissions can upload templates contai...

CVE-2026-40508 OpenEMR < 8.3.0 Stored XSS via Patient Portal Template Import Handler

OpenEMR before 8.3.0 contains a stored cross-site scripting vulnerability in the patient portal template import handler that allows authenticated attackers with Forms Administration permissions to upload template files containing arbitrary HTML or JavaScript. Attackers can inject malicious script...

EUVD-2026-62508

OpenEMR before 8.3.0 contains a stored cross-site scripting vulnerability in the patient portal template import handler that allows authenticated attackers with Forms Administration permissions to upload template files containing arbitrary HTML or JavaScript. Attackers can inject malicious script...