CVE-2026-34055 OpenEMR has IDOR in Patient Notes Web UI allows unauthorized note access/modification

OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 8.0.0.3, the legacy patient notes functions in library/pnotes.inc.php perform updates and deletes using WHERE id = ? without verifying that the note belongs to a patient the...

EUVD-2020-15480

Malware in sbrugna...

PT-2021-22871

Name of the Vulnerable Software and Affected Versions OpenEMR version 6.0.0 Description The issue allows an attacker to read the messages of all users due to an Insecure Direct Object Reference vulnerability. This can be exploited via the pnotes print.php endpoint with the noteid parameter...

Unrestricted file upload

A File Upload Vulnerability in PNotes - Andrey Gruber PNotes.NET v3.8.1.2 allows a local attacker to execute arbitrary code via the Miscellaneous " External Programs by uploading the malicious .exe file to the external program...

CVE-2020-22721

A File Upload Vulnerability in PNotes - Andrey Gruber PNotes.NET v3.8.1.2 allows a local attacker to execute arbitrary code via the Miscellaneous " External Programs by uploading the malicious .exe file to the external program...

CVE-2020-22721

CVE-2020-22721 affects PNotes.NET v3.8.1.2. The vulnerability is a local file upload issue in the “External Programs” feature that allows a local attacker to craft and upload a malicious .exe, enabling arbitrary code execution on the host. The available connected documents reiterate the issue but...

CVE-2020-22721: Unrestricted Upload of File with Dangerous Type

A File Upload Vulnerability in PNotes - Andrey Gruber PNotes.NET v3.8.1.2 allows a local attacker to execute arbitrary code via the Miscellaneous " External Programs by uploading the malicious .exe file to the external program...