CVE-2026-124457

OpenEMR versions before 8.3.0 are vulnerable to a path traversal vulnerability in the interface/billing/sl_eob_process.php component. The root cause is the processing of unsanitized eraname values , which allows authenticated users to read and write files on the system. Specifically, attackers wi...

EUVD-2026-119514

OpenEMR before 8.3.0 contains a path traversal vulnerability in interface/billing/sleobprocess.php that allows authenticated users to write and read files by supplying unsanitized eraname values. Attackers without billing privileges can inject ../ sequences to create ERA report .html files anywhe...

CVE-2026-124457: openemr: OpenEMR before 8.3.0 contains a path traversal vulnerability in interface/billing/sl_eob_process.php that allows…

OpenEMR before 8.3.0 contains a path traversal vulnerability in interface/billing/sleobprocess.php that allows authenticated users to write and read files by supplying unsanitized eraname values. Attackers without billing privileges can inject ../ sequences to create ERA report .html files anywhe...

CVE-2022-29939

In LibreHealth EHR 2.0.0, lack of sanitization of the GET parameters debug and InsId in interface\billing\sleobprocess.php leads to multiple cross-site scripting XSS vulnerabilities...

CVE-2022-29939: Improper Neutralization of Input During Web Page Generation

In LibreHealth EHR 2.0.0, lack of sanitization of the GET parameters debug and InsId in interface\billing\sleobprocess.php leads to multiple cross-site scripting XSS vulnerabilities...

CVE-2018-10571: Improper Neutralization of Input During Web Page Generation

Multiple reflected cross-site scripting XSS vulnerabilities in OpenEMR before 5.0.1 allow remote attackers to inject arbitrary web script or HTML via the 1 patient parameter to interface/main/finder/findernavigation.php; 2 key parameter to interface/billing/getclaimfile.php; 3 formid or 4 formseq...