Advisories · Technology
openemr.
Every CVE that names openemr among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 9.6 CriticalCritical · CVSS 9+
OpenEMR: Missing Write ACL Allows Unauthorized Document Reassignment
- openemr
- Broken access control
- CVSS 5.3 Medium
OpenEMR: Username Enumeration via Pre-Authentication User Settings Loading
- openemr
- Information disclosure
- CWE-208
- CVSS 5.3 Medium
OpenEMR: Unauthenticated Information Disclosure in admin.php Exposes Database Names and Versions
- openemr
- Information disclosure
- Authentication bypass
- CVSS 4.3 Medium
OpenEMR: Unauthenticated Open Redirect via OIDC End Session Endpoint
- openemr
- Open redirect
- CVSS 6.5 Medium
OpenEMR: Missing authorization in person-search AJAX leaks patient demographics (name, DOB, phone, email)
- openemr
- Broken access control
- CVSS 5.4 Medium
OpenEMR: Weno `file_download.php`: missing ACL/CSRF truncates the e-prescribing pharmacy directory
- openemr
- Broken access control
- CVSS 6.5 Medium
OpenEMR: Missing authorization on QRDA Category I/III download endpoints
- openemr
- Broken access control
- CVSS 8.1 High
OpenEMR: Broken Access Control in controller.php Enables Insurance Routing Credential Hijack and PHI Enumeration
- openemr
- Broken access control
- CVSS 7.1 High
OpenEMR: Missing authorization in DORN `compendium_install.php` — non-admin destructive lab-compendium reinstall
- openemr
- Broken access control
- CVSS 8.1 High
OpenEMR: Stored XSS via `text()` Misuse in Double-Quoted HTML Attribute
- openemr
- Cross-site scripting (XSS)
- CVSS 6.5 Medium
OpenEMR: Missing authorization in payment patient-search AJAX leaks patient directory and dates of birth
- openemr
- Broken access control
- CVSS 7.1 High
OpenEMR: Arbitrary Patient Recall and Contact Detail Read
- openemr
- Broken access control
- CVSS 7.1 High
OpenEMR: CSRF Protection Bypass on IPPF Point-of-Sale Void and Regen Operations
- openemr
- Cross-site request forgery (CSRF)
- CVSS 7.1 High
OpenEMR: Patient Data Search Without Sufficient ACL
- openemr
- Broken access control
- CVSS 6.5 Medium
OpenEMR: Missing Authorization on Document Template Download Endpoint Allows Any Authenticated User to Read Another Patient's PHI
- openemr
- Broken access control
- CVSS 7.5 High
OpenEMR FaxSMS module: insecure staging of decrypted patient documents in webroot
- openemr
- Information disclosure
- CVSS 8.7 High
OpenEMR Before 8.5.0 SQL Injection via form_icd_codes[]
- openemr
- SQL injection
- CVSS 5.3 Medium
OpenEMR < 8.3.0 Path Traversal Information Disclosure via EDI Archive Restore
- openemr
- Path traversal
- CVSS 5.3 Medium
OpenEMR < 8.3.0 CSRF via DICOM Viewer web_path Parameter
- openemr
- Cross-site request forgery (CSRF)
- CVSS 5.1 Medium
OpenEMR < 8.3.0 Stored XSS via Patient Portal Template Import Handler
- openemr
- Cross-site scripting (XSS)
- CVSS 5.1 Medium
OpenEMR < 8.3.0 Reflected XSS via templateHtml Parameter in Patient Portal
- openemr
- Cross-site scripting (XSS)
- CVSS 7.0 High
OpenEMR Path Traversal Arbitrary Directory Deletion via standard_tables_manage.php
- openemr
- Path traversal
- CVSS 4.8 Medium
OpenEMR 8.2.0 Stored XSS via import_template.php Template Management
- openemr
- Cross-site scripting (XSS)
- CVSS 8.6 High
OpenEMR 8.2.0 OAuth2 Password Grant Authentication Bypass via SMART Configuration
- openemr
- CWE-308
- CVSS 8.6 High
OpenEMR 8.2.0 OAuth2 Dynamic Client Registration Unauthorized FHIR Access
- openemr
- Authentication bypass
- CVSS 9.4 CriticalCritical · CVSS 9+
OpenEMR 8.2.0 Remote Code Execution via CategoryTree eval() Injection
- openemr
- Code injection
- CVSS 8.6 High
OpenEMR Authenticated SQL Injection via backup.php Import Feature
- openemr
- Unrestricted file upload
- CVSS 7.7 High
OpenEMR: Stored XSS in prescription CSS/HTML print view via patient demographics
- openemr
- Cross-site scripting (XSS)
- Broken access control
- CVSS 7.7 High
OpenEMR has a Privilege Escalation that Allows a Low-Level User to View Admin-Only Data
- openemr
- Broken access control
- CVSS 8.1 High
OpenEMR has IDOR in Patient Notes Web UI allows unauthorized note access/modification
- openemr
- Broken access control
- CVSS 7.1 High
OpenEMR Missing Authorization in Procedure Order AJAX Deletion Handler
- openemr
- Broken access control
- CVSS 5.4 Medium
OpenEMR has Improper ACL On Import/Export Popup
- openemr
- Broken access control
- CVSS 4.3 Medium
OpenEMR's Missing Authorization in show-signature.php Allows Portal Patients to Read Staff Signatures
- openemr
- Broken access control
- CVSS 6.1 Medium
Reflected XSS via Unescaped contextName Parameter in Custom Template Editor
- openemr
- Cross-site scripting (XSS)
- CVSS 7.6 High
OpenEMR has Stored XSS in CCDA Preview via Unsanitized linkHtml Attributes
- openemr
- Cross-site scripting (XSS)
- CVSS 6.5 Medium
OpenEMR has IDOR in Portal Payment Page that Allows Cross-Patient Record Access
- openemr
- Broken access control
- CVSS 7.6 High
OpenEMR Missing Authorization on Claim File Download Endpoint
- openemr
- Broken access control
- CVSS 8.8 High
OpenEMR has SQL Injection in CAMOS Form
- openemr
- SQL injection
- CVSS 5.4 Medium
OpenEMR Missing ACL Checks on Insurance Company API Routes
- openemr
- Broken access control
- CVSS 7.2 High
OpenEMR has SQL Injection in PostCalendar Category Delete
- openemr
- SQL injection
- CVSS 7.7 High
OpenEMR: XInclude Injection in CCDA Import Allows Reading Arbitrary Server Files
- openemr
- XML external entities (XXE)
- CVSS 5.4 Medium
OpenEMR has reflected XSS in ajax_download.php via reportID parameter
- openemr
- Cross-site scripting (XSS)
- CVSS 5.4 Medium
OpenEMR vulnerable to reflected XSS in graphs.php via title parameter
- openemr
- Cross-site scripting (XSS)
- CVSS 7.2 High
OpenEMR has a SQL Injection Vulnerability in patient selection
- openemr
- SQL injection
- CVSS 5.9 Medium
OpenEMR Vulnerable to SQL Injection via Unsanitized Variables in MedEx Recall/Reminder Processing
- openemr
- SQL injection
- CVSS 8.7 High
OpenEMR has Stored XSS in patient encounter Eye Exam form $CHRONIC2 and $CHRONIC3
- openemr
- Cross-site scripting (XSS)
- CVSS 6.5 Medium
OpenEMR has IDOR in Fee Sheet Product Save
- openemr
- Broken access control
- CVSS 8.1 High
OpenEMR Vulnerable to Authenticated Blind Boolean-Based SQL Injection in new_search_popup.php
- openemr
- SQL injection
- CVSS 8.7 High
OpenEMR has stored XSS in portal_payment.php via Unescaped table_args
- openemr
- Cross-site scripting (XSS)
- CVSS 5.4 Medium
OpenEMR has Authorization Bypass in FaxSMS AppDispatch Constructor
- openemr
- Broken access control
- CWE-696
- CVSS 6.5 Medium
OpenEMR has Authorization Bypass in Dated Reminders Log
- openemr
- Broken access control
- CVSS 5.4 Medium
OpenEMR Vulnerable to Stored XSS via Unescaped portal_login_username in Credential Print View
- openemr
- Cross-site scripting (XSS)
- CVSS 7.3 High
OpenEMR: zhAclCheck Ignores Explicit ACL Denies
- openemr
- Broken access control
- CVSS 7.2 High
OpenEMR has Out-of-Band Server-Side Request Forgery (OOB SSRF)
- openemr
- Server-side request forgery (SSRF)
- CVSS 7.1 High
OpenEMR has arbitrary image file read via PDF generator
- openemr
- CWE-116
- CVSS 8.5 High
OpenEMR has Stored XSS in patient encounter Eye Exam form answers
- openemr
- Cross-site scripting (XSS)
- CVSS 4.4 Medium
OpenEMR has Stored DOM XSS via SearchHighlight text-node reconstruction on Custom Report page
- openemr
- Cross-site scripting (XSS)
- CVSS 9.1 CriticalCritical · CVSS 9+
OpenEMR has Remote Code Execution in backup functionality
- openemr
- Command injection
- CVSS 6.5 Medium
OpenEMR Vulnerable to Path Traversal When Zipping DICOM Folders
- openemr
- Path traversal
- CVSS 6.5 Medium
OpenEMR: POST /api/.../vital Accepts Attacker-Supplied id and Overwrites Arbitrary Vitals
- openemr
- Broken access control