Browse CVEs

HIGH 8.8 CVE-2021-32104 A SQL injection vulnerability exists (with user privileges) in interface/forms/eye_mag/save.php in OpenEMR 5.0.2.1. Openemr Patch available Fix from $1,9502021-05-07 HIGH 8.2 CVE-2021-32101 The Patient Portal of OpenEMR 5.0.2.1 is affected by a incorrect access control system in portal/patient/_machine_config.php. To exploit the vulnerab… Openemr Mitigation only Fix from $1,9502021-05-07 HIGH 8.8 CVE-2020-13566 SQL injection vulnerabilities exist in phpGACL 3.3.7. A specially crafted HTTP request can lead to a SQL injection. An attacker can send an HTTP requ… Openemr No fix yet Fix from $1,9502021-04-13 HIGH 8.8 CVE-2020-13568EPSS 30% SQL injection vulnerability exists in phpGACL 3.3.7. A specially crafted HTTP request can lead to a SQL injection. An attacker can send an HTTP reque… Openemr No fix yet Fix from $1,9502021-04-13 MEDIUM 6.1 CVE-2021-25922 In OpenEMR, versions 4.2.0 to 6.0.0 are vulnerable to Reflected Cross-Site-Scripting (XSS) due to user input not being validated properly. An attacke… Openemr after 6.0.0 Fix from $1,6002021-03-22 MEDIUM 6.5 CVE-2021-25920 In OpenEMR, versions v2.7.2-rc1 to 6.0.0 are vulnerable to Improper Access Control when creating a new user, which leads to a malicious user able to … Openemr after 6.0.0 Fix from $1,6002021-03-22 MEDIUM 5.4 CVE-2021-25921EPSS 91% In OpenEMR, versions 2.7.3-rc1 to 6.0.0 are vulnerable to Stored Cross-Site-Scripting (XSS) due to user input not being validated properly in the `Al… Openemr after 6.0.0 Fix from $1,6002021-03-22 HIGH 7.2 CVE-2020-29140 A SQL injection vulnerability in interface/reports/immunization_report.php in OpenEMR before 5.0.2.5 allows a remote authenticated attacker to execut… Openemr 5.0.2.5+ Fix from $1,9502021-02-15 HIGH 7.2 CVE-2020-29143 A SQL injection vulnerability in interface/reports/non_reported.php in OpenEMR before 5.0.2.5 allows a remote authenticated attacker to execute arbit… Openemr 5.0.2.5+ Fix from $1,9502021-02-15 HIGH 7.2 CVE-2020-29139 A SQL injection vulnerability in interface/main/finder/patient_select.php from library/patient.inc in OpenEMR before 5.0.2.5 allows a remote authenti… Openemr 5.0.2.5+ Fix from $1,9502021-02-15 HIGH 7.2 CVE-2020-29142 A SQL injection vulnerability in interface/usergroup/usergroup_admin.php in OpenEMR before 5.0.2.5 allows a remote authenticated attacker to execute … Openemr 5.0.2.5+ Fix from $1,9502021-02-15 MEDIUM 6.1 CVE-2020-13565 An open redirect vulnerability exists in the return_page redirection functionality of phpGACL 3.3.7, OpenEMR 5.0.2 and OpenEMR development version 6.… Openemr No fix yet Fix from $1,6002021-02-10 HIGH 8.8 CVE-2020-36243EPSS 64% The Patient Portal of OpenEMR 5.0.2.1 is affected by a Command Injection vulnerability in /interface/main/backup.php. To exploit the vulnerability, a… Openemr Patch available Fix from $1,9502021-02-07 HIGH 8.8 CVE-2020-13569 A cross-site request forgery vulnerability exists in the GACL functionality of OpenEMR 5.0.2 and development version 6.0.0 (commit babec93f600ff1394f… Openemr No fix yet Fix from $1,9502021-01-28 HIGH 8.8 CVE-2020-19364EPSS 71% OpenEMR 5.0.1 allows an authenticated attacker to upload and execute malicious PHP scripts through /controller.php. Openemr No fix yet Fix from $1,9502021-01-20 HIGH 8.8 CVE-2018-16795 OpenEMR 5.0.1.3 allows Cross-Site Request Forgery (CSRF) via library/ajax and interface/super, as demonstrated by use of interface/super/manage_site_… Openemr No fix yet Fix from $1,9502020-12-31 HIGH 8.8 CVE-2019-16404 Authenticated SQL Injection in interface/forms/eye_mag/js/eye_base.php in OpenEMR through 5.0.2 allows a user to extract arbitrary data from the open… Openemr after 5.0.2 Fix from $1,9502019-10-21 MEDIUM 6.1 CVE-2019-16862 Reflected XSS in interface/forms/eye_mag/view.php in OpenEMR 5.x before 5.0.2.1 allows a remote attacker to execute arbitrary code in the context of … Openemr 5.0.2.1+ Fix from $1,6002019-10-21 MEDIUM 6.1 CVE-2019-17409 Reflected XSS exists in interface/forms/eye_mag/view.php in OpenEMR 5.x before 5.0.2.1 ia the id parameter. Openemr 5.0.2.1+ Fix from $1,6002019-10-21 CRITICAL 9.8 CVE-2019-17197 OpenEMR through 5.0.2 has SQL Injection in the Lifestyle demographic filter criteria in library/clinical_rules.php that affects library/patient.inc. Openemr after 5.0.2 Fix from $2,3002019-10-05 MEDIUM 6.1 CVE-2019-17179 4.1.0, 4.1.1, 4.1.2, 4.1.2.3, 4.1.2.6, 4.1.2.7, 4.2.0, 4.2.1, 4.2.2, 5.0.0, 5.0.0.5, 5.0.0.6, 5.0.1, 5.0.1.1, 5.0.1.2, 5.0.1.3, 5.0.1.4, 5.0.1.5, 5.0… Openemr after 5.0.2 Fix from $1,6002019-10-04 MEDIUM 6.1 CVE-2019-8368EPSS 47% OpenEMR v5.0.1-6 allows XSS. Openemr No fix yet Fix from $1,6002019-09-16 HIGH 7.2 CVE-2019-8371 OpenEMR v5.0.1-6 allows code execution. Openemr No fix yet Fix from $1,9502019-09-16 HIGH 8.8 CVE-2019-3968EPSS 10% In OpenEMR 5.0.1 and earlier, an authenticated attacker can execute arbitrary commands on the host system via the Scanned Forms interface when creati… Openemr after 5.0.1 Fix from $1,9502019-08-20 MEDIUM 6.5 CVE-2019-3967EPSS 29% In OpenEMR 5.0.1 and earlier, the patient file download interface contains a directory traversal flaw that allows authenticated attackers to download… Openemr after 5.0.1 Fix from $1,6002019-08-20 MEDIUM 6.1 CVE-2019-3963EPSS 53% In OpenEMR 5.0.1 and earlier, controller.php contains a reflected XSS vulnerability in the patient_id parameter. This could allow an attacker to exec… Openemr after 5.0.1 Fix from $1,6002019-08-20 MEDIUM 6.1 CVE-2019-3964EPSS 53% In OpenEMR 5.0.1 and earlier, controller.php contains a reflected XSS vulnerability in the doc_id parameter. This could allow an attacker to execute … Openemr after 5.0.1 Fix from $1,6002019-08-20 MEDIUM 6.1 CVE-2019-3965 In OpenEMR 5.0.1 and earlier, controller.php contains a reflected XSS vulnerability in the document_id parameter. This could allow an attacker to exe… Openemr after 5.0.1 Fix from $1,6002019-08-20 MEDIUM 6.1 CVE-2019-3966 In OpenEMR 5.0.1 and earlier, controller.php contains a reflected XSS vulnerability in the foreign_id parameter. This could allow an attacker to exec… Openemr after 5.0.1 Fix from $1,6002019-08-20 HIGH 8.8 CVE-2019-14530EPSS 66% An issue was discovered in custom/ajax_download.php in OpenEMR before 5.0.2 via the fileName parameter. An attacker can download any file (that is re… Openemr 5.0.2+ Fix from $1,9502019-08-13