Advisories · Technology
openemr/openemr.
Every CVE that names openemr/openemr among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 8.1 High
Stored XSS in openemr/openemr
- openemr/openemr
- Cross-site scripting (XSS)
- CVSS 6.3 Medium
Improper Authorization in openemr/openemr
- openemr/openemr
- Broken access control
- CVSS 8.3 High
Cross-site Scripting (XSS) - Reflected in openemr/openemr
- openemr/openemr
- Cross-site scripting (XSS)
- CVSS 8.3 HighCritical · CVSS 7+ and EPSS
Cross-site Scripting (XSS) - Generic in openemr/openemr
- openemr/openemr
- Cross-site scripting (XSS)
- CVSS 4.7 Medium
Cross-site Scripting (XSS) - Stored in openemr/openemr
- openemr/openemr
- Cross-site scripting (XSS)
- CVSS 6.3 Medium
Improper Access Control in openemr/openemr
- openemr/openemr
- Broken access control
- CVSS 4.3 Medium
Missing Authorization in openemr/openemr
- openemr/openemr
- Broken access control
- CVSS 6.3 Medium
Improper Access Control in openemr/openemr
- openemr/openemr
- Broken access control
- CVSS 4.6 Medium
Code Injection in openemr/openemr
- openemr/openemr
- Code injection
- CVSS 8.1 High
Improper Input Validation in openemr/openemr
- openemr/openemr
- CWE-20
- CVSS 8.8 High
Improper Access Control in openemr/openemr
- openemr/openemr
- Broken access control
- CVSS 7.5 High
Cross-site Scripting (XSS) - Stored in openemr/openemr
- openemr/openemr
- Cross-site scripting (XSS)
- CVSS 6.7 Medium
Cross-site Scripting (XSS) - Stored in openemr/openemr
- openemr/openemr
- Cross-site scripting (XSS)
- CVSS 8.3 High
Cross-site Scripting (XSS) - Reflected in openemr/openemr
- openemr/openemr
- Cross-site scripting (XSS)
- CVSS 8.1 High
Improper Access Control in openemr/openemr
- openemr/openemr
- Broken access control
- CVSS 7.6 High
Unrestricted Upload of File with Dangerous Type in openemr/openemr
- openemr/openemr
- Unrestricted file upload
- CVSS 8.8 High
Authorization Bypass Through User-Controlled Key in openemr/openemr
- openemr/openemr
- Broken access control
- CVSS 7.1 High
Improper Input Validation in openemr/openemr
- openemr/openemr
- CWE-20
- CVSS 6.4 Medium
Cross-site Scripting (XSS) - Generic in openemr/openemr
- openemr/openemr
- Cross-site scripting (XSS)
- CVSS 7.3 High
Cross-site Scripting (XSS) - Reflected in openemr/openemr
- openemr/openemr
- Cross-site scripting (XSS)
- CVSS 8.8 High
Authorization Bypass Through User-Controlled Key in openemr/openemr
- openemr/openemr
- Broken access control
- CVSS 10.0 CriticalCritical · CVSS 9+
Improper Restriction of Rendered UI Layers or Frames in openemr/openemr
- openemr/openemr
- CWE-1021
- CVSS 8.3 High
Missing Authorization in openemr/openemr
- openemr/openemr
- Broken access control
- CVSS 9.6 CriticalCritical · CVSS 9+, CVSS 7+ and EPSS
Cross-site Scripting (XSS) - Reflected in openemr/openemr
- openemr/openemr
- Cross-site scripting (XSS)
- CVSS 5.4 Medium
Cross-site Scripting (XSS) - Reflected in openemr/openemr
- openemr/openemr
- Cross-site scripting (XSS)
- CVSS 5.4 Medium
Cross-site Scripting (XSS) - DOM in openemr/openemr
- openemr/openemr
- Cross-site scripting (XSS)
- CVSS 6.5 Medium
Authorization Bypass Through User-Controlled Key in openemr/openemr
- openemr/openemr
- Broken access control
- CVSS 6.3 Medium
Cross-site Scripting (XSS) - Stored in openemr/openemr
- openemr/openemr
- Cross-site scripting (XSS)
- CVSS 8.3 High
Data Access from Outside Expected Data Manager Component in openemr/openemr
- openemr/openemr
- CWE-1083
- CVSS 8.1 High
Non Privilege User can Enable or Disable Registered in openemr/openemr
- openemr/openemr
- CWE-1220
- CVSS 8.3 High
Non-Privilege User Can View Patient’s Disclosures in openemr/openemr
- openemr/openemr
- CWE-1118
- CVSS 7.3 High
Stored XSS Leads To Session Hijacking in openemr/openemr
- openemr/openemr
- Cross-site scripting (XSS)
- CVSS 4.6 Medium
Non-Privilege User Can Created New Rule and Lead to Stored Cross Site Scripting in openemr/openemr
- openemr/openemr
- Cross-site scripting (XSS)
- CVSS 4.6 Medium
Reflected Cross Site Scripting in openemr/openemr
- openemr/openemr
- Cross-site scripting (XSS)
- CVSS 8.0 HighCritical · CVSS 7+ and EPSS
Stored Cross Site Scripting in openemr/openemr
- openemr/openemr
- Cross-site scripting (XSS)
- CVSS 6.5 Medium
Accounting User Can Download Patient Reports in openemr in openemr/openemr
- openemr/openemr
- CWE-1220
- CVSS 7.3 HighCritical · CVSS 7+ and EPSS
Stored Cross Site Scripting in openemr/openemr
- openemr/openemr
- Cross-site scripting (XSS)