CVE-2026-104134

OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.3.0, the searchpersons action in library/ajax/personsearchajax.php validates CSRF but does not perform an AclMain authorization check before searching the person and patientdata...

CVE-2026-104135

OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.3.0, library/ajax/paymentajax.php validates a CSRF token but performs no AclMain authorization check before executing a wildcard search of patientdata. Any authenticated user,...

CVE-2026-104134

In OpenEMR versions prior to 8.3.0 , a missing AclMain authorization check in the search_persons action (found in library/ajax/person_search_ajax.php) allows for unauthorized data access. While the application validates CSRF, it fails to verify permissions before querying the person and patient_d...

CVE-2026-104135 OpenEMR: Missing authorization in payment patient-search AJAX leaks patient directory and dates of birth

OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.3.0, library/ajax/paymentajax.php validates a CSRF token but performs no AclMain authorization check before executing a wildcard search of patientdata. Any authenticated user,...

CVE-2026-104135 OpenEMR: Missing authorization in payment patient-search AJAX leaks patient directory and dates of birth

OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.3.0, library/ajax/paymentajax.php validates a CSRF token but performs no AclMain authorization check before executing a wildcard search of patientdata. Any authenticated user,...

EUVD-2026-117769

OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.3.0, library/ajax/paymentajax.php validates a CSRF token but performs no AclMain authorization check before executing a wildcard search of patientdata. Any authenticated user,...

CVE-2026-104135

Versions of OpenEMR prior to 8.3.0 are vulnerable to a missing authorization flaw in the library/ajax/payment_ajax.php component. While the application validates CSRF tokens, it fails to perform an AclMain authorization check before executing a wildcard search of patient_data. This allows any aut...

CVE-2026-46518: Improper Neutralization of Input During Web Page Generation

OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 8.0.0.1, a stored cross-site scripting vulnerability in the prescription CSS/HTML multi-print feature allows a patient portal user to execute arbitrary JavaScript in a...

CVE-2026-32121: Improper Neutralization of Input During Web Page Generation

OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.0.0.1, Stored XSS in prescription CSS/HTML print view via patient demographics. That finding involves server-side rendering of patient names via raw PHP echo. This finding involves...