# openemr.

Every CVE that names openemr among its affected products, newest first. Vendors and products are as the CNA wrote them.

## Records, newest first

- [OpenEMR: Missing Write ACL Allows Unauthorized Document Reassignment](https://agentprime.io/advisories/CVE-2026-102940.md)
  `CVE-2026-102940` · CVE record: openemr openemr · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 5 Nov 2026 · Tags: Broken access control
- [OpenEMR: Username Enumeration via Pre-Authentication User Settings Loading](https://agentprime.io/advisories/CVE-2026-103021.md)
  `CVE-2026-103021` · CVE record: openemr openemr · CVSS 5.3 Medium · Not analysed yet · Published 5 Nov 2026 · Tags: Information disclosure, CWE-208
- [OpenEMR: Unauthenticated Information Disclosure in admin.php Exposes Database Names and Versions](https://agentprime.io/advisories/CVE-2026-103020.md)
  `CVE-2026-103020` · CVE record: openemr openemr · CVSS 5.3 Medium · Not analysed yet · Published 5 Nov 2026 · Tags: Information disclosure, Authentication bypass
- [OpenEMR: Unauthenticated Open Redirect via OIDC End Session Endpoint](https://agentprime.io/advisories/CVE-2026-103019.md)
  `CVE-2026-103019` · CVE record: openemr openemr · CVSS 4.3 Medium · Not analysed yet · Published 5 Nov 2026 · Tags: Open redirect
- [OpenEMR: Missing authorization in person-search AJAX leaks patient demographics (name, DOB, phone, email)](https://agentprime.io/advisories/CVE-2026-104134.md)
  `CVE-2026-104134` · CVE record: openemr openemr · CVSS 6.5 Medium · Not analysed yet · Published 5 Nov 2026 · Tags: Broken access control
- [OpenEMR: Weno \`file_download.php\`: missing ACL/CSRF truncates the e-prescribing pharmacy directory](https://agentprime.io/advisories/CVE-2026-103939.md)
  `CVE-2026-103939` · CVE record: openemr openemr · CVSS 5.4 Medium · Not analysed yet · Published 5 Nov 2026 · Tags: Broken access control
- [OpenEMR: Missing authorization on QRDA Category I/III download endpoints](https://agentprime.io/advisories/CVE-2026-104138.md)
  `CVE-2026-104138` · CVE record: openemr openemr · CVSS 6.5 Medium · Not analysed yet · Published 5 Nov 2026 · Tags: Broken access control
- [OpenEMR: Broken Access Control in controller.php Enables Insurance Routing Credential Hijack and PHI Enumeration](https://agentprime.io/advisories/CVE-2026-115573.md)
  `CVE-2026-115573` · CVE record: openemr openemr · CVSS 8.1 High · Not analysed yet · Published 5 Nov 2026 · Tags: Broken access control
- [OpenEMR: Missing authorization in DORN \`compendium_install.php\` — non-admin destructive lab-compendium reinstall](https://agentprime.io/advisories/CVE-2026-104133.md)
  `CVE-2026-104133` · CVE record: openemr openemr · CVSS 7.1 High · Not analysed yet · Published 5 Nov 2026 · Tags: Broken access control
- [OpenEMR: Stored XSS via \`text()\` Misuse in Double-Quoted HTML Attribute](https://agentprime.io/advisories/CVE-2026-103935.md)
  `CVE-2026-103935` · CVE record: openemr openemr · CVSS 8.1 High · Not analysed yet · Published 5 Nov 2026 · Tags: Cross-site scripting (XSS)
- [OpenEMR: Missing authorization in payment patient-search AJAX leaks patient directory and dates of birth](https://agentprime.io/advisories/CVE-2026-104135.md)
  `CVE-2026-104135` · CVE record: openemr openemr · CVSS 6.5 Medium · Not analysed yet · Published 5 Nov 2026 · Tags: Broken access control
- [OpenEMR: Arbitrary Patient Recall and Contact Detail Read](https://agentprime.io/advisories/CVE-2026-104136.md)
  `CVE-2026-104136` · CVE record: openemr openemr · CVSS 7.1 High · Not analysed yet · Published 5 Nov 2026 · Tags: Broken access control
- [OpenEMR: CSRF Protection Bypass on IPPF Point-of-Sale Void and Regen Operations](https://agentprime.io/advisories/CVE-2026-103938.md)
  `CVE-2026-103938` · CVE record: openemr openemr · CVSS 7.1 High · Not analysed yet · Published 5 Nov 2026 · Tags: Cross-site request forgery (CSRF)
- [OpenEMR: Patient Data Search Without Sufficient ACL](https://agentprime.io/advisories/CVE-2026-104137.md)
  `CVE-2026-104137` · CVE record: openemr openemr · CVSS 7.1 High · Not analysed yet · Published 5 Nov 2026 · Tags: Broken access control
- [OpenEMR: Missing Authorization on Document Template Download Endpoint Allows Any Authenticated User to Read Another Patient's PHI](https://agentprime.io/advisories/CVE-2026-104139.md)
  `CVE-2026-104139` · CVE record: openemr openemr · CVSS 6.5 Medium · Not analysed yet · Published 5 Nov 2026 · Tags: Broken access control
- [OpenEMR FaxSMS module: insecure staging of decrypted patient documents in webroot](https://agentprime.io/advisories/CVE-2026-65983.md)
  `CVE-2026-65983` · CVE record: openemr openemr · CVSS 7.5 High · Not analysed yet · Published 5 Nov 2026 · Tags: Information disclosure
- [OpenEMR Before 8.5.0 SQL Injection via form_icd_codes\[\]](https://agentprime.io/advisories/CVE-2026-49142.md)
  `CVE-2026-49142` · CVE record: openemr openemr · CVSS 8.7 High · Not analysed yet · Published 29 Oct 2026 · Tags: SQL injection
- [OpenEMR < 8.3.0 Path Traversal Information Disclosure via EDI Archive Restore](https://agentprime.io/advisories/CVE-2026-76614.md)
  `CVE-2026-76614` · CVE record: openemr openemr · CVSS 5.3 Medium · Not analysed yet · Published 19 Aug 2026 · Tags: Path traversal
- [OpenEMR < 8.3.0 CSRF via DICOM Viewer web_path Parameter](https://agentprime.io/advisories/CVE-2026-40509.md)
  `CVE-2026-40509` · CVE record: openemr openemr · CVSS 5.3 Medium · Not analysed yet · Published 19 Aug 2026 · Tags: Cross-site request forgery (CSRF)
- [OpenEMR < 8.3.0 Stored XSS via Patient Portal Template Import Handler](https://agentprime.io/advisories/CVE-2026-40508.md)
  `CVE-2026-40508` · CVE record: openemr openemr · CVSS 5.1 Medium · Not analysed yet · Published 19 Aug 2026 · Tags: Cross-site scripting (XSS)
- [OpenEMR < 8.3.0 Reflected XSS via templateHtml Parameter in Patient Portal](https://agentprime.io/advisories/CVE-2026-40507.md)
  `CVE-2026-40507` · CVE record: openemr openemr · CVSS 5.1 Medium · Not analysed yet · Published 19 Aug 2026 · Tags: Cross-site scripting (XSS)
- [OpenEMR Path Traversal Arbitrary Directory Deletion via standard_tables_manage.php](https://agentprime.io/advisories/CVE-2026-40506.md)
  `CVE-2026-40506` · CVE record: openemr openemr · CVSS 7.0 High · Not analysed yet · Published 17 Aug 2026 · Tags: Path traversal
- [OpenEMR 8.2.0 Stored XSS via import_template.php Template Management](https://agentprime.io/advisories/CVE-2026-67612.md)
  `CVE-2026-67612` · CVE record: openemr openemr · CVSS 4.8 Medium · Not analysed yet · Published 3 Aug 2026 · Tags: Cross-site scripting (XSS)
- [OpenEMR 8.2.0 OAuth2 Password Grant Authentication Bypass via SMART Configuration](https://agentprime.io/advisories/CVE-2026-67611.md)
  `CVE-2026-67611` · CVE record: openemr openemr · CVSS 8.6 High · Not analysed yet · Published 3 Aug 2026 · Tags: CWE-308
- [OpenEMR 8.2.0 OAuth2 Dynamic Client Registration Unauthorized FHIR Access](https://agentprime.io/advisories/CVE-2026-67610.md)
  `CVE-2026-67610` · CVE record: openemr openemr · CVSS 8.6 High · Not analysed yet · Published 3 Aug 2026 · Tags: Authentication bypass
- [OpenEMR 8.2.0 Remote Code Execution via CategoryTree eval() Injection](https://agentprime.io/advisories/CVE-2026-39932.md)
  `CVE-2026-39932` · CVE record: openemr openemr · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 3 Aug 2026 · Tags: Code injection
- [OpenEMR Authenticated SQL Injection via backup.php Import Feature](https://agentprime.io/advisories/CVE-2026-39931.md)
  `CVE-2026-39931` · CVE record: openemr openemr · CVSS 8.6 High · Not analysed yet · Published 3 Aug 2026 · Tags: Unrestricted file upload
- [OpenEMR: Stored XSS in prescription CSS/HTML print view via patient demographics](https://agentprime.io/advisories/CVE-2026-46518.md)
  `CVE-2026-46518` · CVE record: openemr openemr · CVSS 7.7 High · Not analysed yet · Published 9 Jun 2026 · Tags: Cross-site scripting (XSS), Broken access control
- [OpenEMR has a Privilege Escalation that Allows a Low-Level User to View Admin-Only Data](https://agentprime.io/advisories/CVE-2026-34056.md)
  `CVE-2026-34056` · CVE record: openemr openemr · CVSS 7.7 High · Not analysed yet · Published 25 Mar 2026 · Tags: Broken access control
- [OpenEMR has IDOR in Patient Notes Web UI allows unauthorized note access/modification](https://agentprime.io/advisories/CVE-2026-34055.md)
  `CVE-2026-34055` · CVE record: openemr openemr · CVSS 8.1 High · Not analysed yet · Published 25 Mar 2026 · Tags: Broken access control
- [OpenEMR Missing Authorization in Procedure Order AJAX Deletion Handler](https://agentprime.io/advisories/CVE-2026-34053.md)
  `CVE-2026-34053` · CVE record: openemr openemr · CVSS 7.1 High · Not analysed yet · Published 25 Mar 2026 · Tags: Broken access control
- [OpenEMR has Improper ACL On Import/Export Popup](https://agentprime.io/advisories/CVE-2026-34051.md)
  `CVE-2026-34051` · CVE record: openemr openemr · CVSS 5.4 Medium · Not analysed yet · Published 25 Mar 2026 · Tags: Broken access control
- [OpenEMR's Missing Authorization in show-signature.php Allows Portal Patients to Read Staff Signatures](https://agentprime.io/advisories/CVE-2026-33934.md)
  `CVE-2026-33934` · CVE record: openemr openemr · CVSS 4.3 Medium · Not analysed yet · Published 25 Mar 2026 · Tags: Broken access control
- [Reflected XSS via Unescaped contextName Parameter in Custom Template Editor](https://agentprime.io/advisories/CVE-2026-33933.md)
  `CVE-2026-33933` · CVE record: openemr openemr · CVSS 6.1 Medium · Not analysed yet · Published 25 Mar 2026 · Tags: Cross-site scripting (XSS)
- [OpenEMR has Stored XSS in CCDA Preview via Unsanitized linkHtml Attributes](https://agentprime.io/advisories/CVE-2026-33932.md)
  `CVE-2026-33932` · CVE record: openemr openemr · CVSS 7.6 High · Not analysed yet · Published 25 Mar 2026 · Tags: Cross-site scripting (XSS)
- [OpenEMR has IDOR in Portal Payment Page that Allows Cross-Patient Record Access](https://agentprime.io/advisories/CVE-2026-33931.md)
  `CVE-2026-33931` · CVE record: openemr openemr · CVSS 6.5 Medium · Not analysed yet · Published 25 Mar 2026 · Tags: Broken access control
- [OpenEMR Missing Authorization on Claim File Download Endpoint](https://agentprime.io/advisories/CVE-2026-33918.md)
  `CVE-2026-33918` · CVE record: openemr openemr · CVSS 7.6 High · Not analysed yet · Published 25 Mar 2026 · Tags: Broken access control
- [OpenEMR has SQL Injection in CAMOS Form](https://agentprime.io/advisories/CVE-2026-33917.md)
  `CVE-2026-33917` · CVE record: openemr openemr · CVSS 8.8 High · Not analysed yet · Published 25 Mar 2026 · Tags: SQL injection
- [OpenEMR Missing ACL Checks on Insurance Company API Routes](https://agentprime.io/advisories/CVE-2026-33915.md)
  `CVE-2026-33915` · CVE record: openemr openemr · CVSS 5.4 Medium · Not analysed yet · Published 25 Mar 2026 · Tags: Broken access control
- [OpenEMR has SQL Injection in PostCalendar Category Delete](https://agentprime.io/advisories/CVE-2026-33914.md)
  `CVE-2026-33914` · CVE record: openemr openemr · CVSS 7.2 High · Not analysed yet · Published 25 Mar 2026 · Tags: SQL injection
- [OpenEMR: XInclude Injection in CCDA Import Allows Reading Arbitrary Server Files](https://agentprime.io/advisories/CVE-2026-33913.md)
  `CVE-2026-33913` · CVE record: openemr openemr · CVSS 7.7 High · Not analysed yet · Published 25 Mar 2026 · Tags: XML external entities (XXE)
- [OpenEMR has reflected XSS in ajax_download.php via reportID parameter](https://agentprime.io/advisories/CVE-2026-33912.md)
  `CVE-2026-33912` · CVE record: openemr openemr · CVSS 5.4 Medium · Not analysed yet · Published 25 Mar 2026 · Tags: Cross-site scripting (XSS)
- [OpenEMR vulnerable to reflected XSS in graphs.php via title parameter](https://agentprime.io/advisories/CVE-2026-33911.md)
  `CVE-2026-33911` · CVE record: openemr openemr · CVSS 5.4 Medium · Not analysed yet · Published 25 Mar 2026 · Tags: Cross-site scripting (XSS)
- [OpenEMR has a SQL Injection Vulnerability in patient selection](https://agentprime.io/advisories/CVE-2026-33910.md)
  `CVE-2026-33910` · CVE record: openemr openemr · CVSS 7.2 High · Not analysed yet · Published 25 Mar 2026 · Tags: SQL injection
- [OpenEMR Vulnerable to SQL Injection via Unsanitized Variables in MedEx Recall/Reminder Processing](https://agentprime.io/advisories/CVE-2026-33909.md)
  `CVE-2026-33909` · CVE record: openemr openemr · CVSS 5.9 Medium · Not analysed yet · Published 25 Mar 2026 · Tags: SQL injection
- [OpenEMR has Stored XSS in patient encounter Eye Exam form $CHRONIC2 and $CHRONIC3](https://agentprime.io/advisories/CVE-2026-33348.md)
  `CVE-2026-33348` · CVE record: openemr openemr · CVSS 8.7 High · Not analysed yet · Published 25 Mar 2026 · Tags: Cross-site scripting (XSS)
- [OpenEMR has IDOR in Fee Sheet Product Save](https://agentprime.io/advisories/CVE-2026-32120.md)
  `CVE-2026-32120` · CVE record: openemr openemr · CVSS 6.5 Medium · Not analysed yet · Published 25 Mar 2026 · Tags: Broken access control
- [OpenEMR Vulnerable to Authenticated Blind Boolean-Based SQL Injection in new_search_popup.php](https://agentprime.io/advisories/CVE-2026-29187.md)
  `CVE-2026-29187` · CVE record: openemr openemr · CVSS 8.1 High · Not analysed yet · Published 25 Mar 2026 · Tags: SQL injection
- [OpenEMR has stored XSS in portal_payment.php via Unescaped table_args](https://agentprime.io/advisories/CVE-2026-33346.md)
  `CVE-2026-33346` · CVE record: openemr openemr · CVSS 8.7 High · Not analysed yet · Published 19 Mar 2026 · Tags: Cross-site scripting (XSS)
- [OpenEMR has Authorization Bypass in FaxSMS AppDispatch Constructor](https://agentprime.io/advisories/CVE-2026-33305.md)
  `CVE-2026-33305` · CVE record: openemr openemr · CVSS 5.4 Medium · Not analysed yet · Published 19 Mar 2026 · Tags: Broken access control, CWE-696
- [OpenEMR has Authorization Bypass in Dated Reminders Log](https://agentprime.io/advisories/CVE-2026-33304.md)
  `CVE-2026-33304` · CVE record: openemr openemr · CVSS 6.5 Medium · Not analysed yet · Published 19 Mar 2026 · Tags: Broken access control
- [OpenEMR Vulnerable to Stored XSS via Unescaped portal_login_username in Credential Print View](https://agentprime.io/advisories/CVE-2026-33303.md)
  `CVE-2026-33303` · CVE record: openemr openemr · CVSS 5.4 Medium · Not analysed yet · Published 19 Mar 2026 · Tags: Cross-site scripting (XSS)
- [OpenEMR: zhAclCheck Ignores Explicit ACL Denies](https://agentprime.io/advisories/CVE-2026-33302.md)
  `CVE-2026-33302` · CVE record: openemr openemr · CVSS 7.3 High · Not analysed yet · Published 19 Mar 2026 · Tags: Broken access control
- [OpenEMR has Out-of-Band Server-Side Request Forgery (OOB SSRF)](https://agentprime.io/advisories/CVE-2026-33321.md)
  `CVE-2026-33321` · CVE record: openemr openemr · CVSS 7.2 High · Not analysed yet · Published 19 Mar 2026 · Tags: Server-side request forgery (SSRF)
- [OpenEMR has arbitrary image file read via PDF generator](https://agentprime.io/advisories/CVE-2026-33301.md)
  `CVE-2026-33301` · CVE record: openemr openemr · CVSS 7.1 High · Not analysed yet · Published 19 Mar 2026 · Tags: CWE-116
- [OpenEMR has Stored XSS in patient encounter Eye Exam form answers](https://agentprime.io/advisories/CVE-2026-33299.md)
  `CVE-2026-33299` · CVE record: openemr openemr · CVSS 8.5 High · Not analysed yet · Published 19 Mar 2026 · Tags: Cross-site scripting (XSS)
- [OpenEMR has Stored DOM XSS via SearchHighlight text-node reconstruction on Custom Report page](https://agentprime.io/advisories/CVE-2026-32119.md)
  `CVE-2026-32119` · CVE record: openemr openemr · CVSS 4.4 Medium · Not analysed yet · Published 19 Mar 2026 · Tags: Cross-site scripting (XSS)
- [OpenEMR has Remote Code Execution in backup functionality](https://agentprime.io/advisories/CVE-2026-32238.md)
  `CVE-2026-32238` · CVE record: openemr openemr · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 19 Mar 2026 · Tags: Command injection
- [OpenEMR Vulnerable to Path Traversal When Zipping DICOM Folders](https://agentprime.io/advisories/CVE-2026-25928.md)
  `CVE-2026-25928` · CVE record: openemr openemr · CVSS 6.5 Medium · Not analysed yet · Published 19 Mar 2026 · Tags: Path traversal
- [OpenEMR: POST /api/.../vital Accepts Attacker-Supplied id and Overwrites Arbitrary Vitals](https://agentprime.io/advisories/CVE-2026-25744.md)
  `CVE-2026-25744` · CVE record: openemr openemr · CVSS 6.5 Medium · Not analysed yet · Published 19 Mar 2026 · Tags: Broken access control

Older: <https://agentprime.io/advisories/technology/openemr.md?cursor=WyIyMDI2LTAzLTE5VDE5OjI1OjU2LjQ3NDAwMFoiLCJDVkUtMjAyNi0yNTc0NCJd>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?technology=openemr>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/technology/openemr/>. Everything for agents: <https://agentprime.io/llms.txt>.