openemr.

OpenEMR's Message Update Ignores Patient id

• openemr
• Broken access control

SQL Injection Vulnerability in ajax graphs library (OpenEMR)

• openemr
• SQL injection

OpenEMR: Inverted ACL Condition in CDR ControllerRouter Allows Any Authenticated User to Modify/Delete Clinical Rules and Plans

• openemr
• Broken access control

OpenEMR: Stored XSS in Track Anything Graphs via Unescaped Dygraph Titles/Labels

• openemr
• Cross-site scripting (XSS)

OpenEMR: Dynamic Code Picker Renders Unescaped Descriptions (Stored XSS)

• openemr
• Cross-site scripting (XSS)

OpenEMR: Therapy Group Sensitivity ACL No Longer Enforced

• openemr
• Broken access control

OpenEMR: Missing Authorization on Claim File Tracker UI and AJAX Endpoint (V2)

• openemr
• Broken access control

OpenEMR: Stored DOM XSS via `.html()` in Portal Signer Modal

• openemr
• Cross-site scripting (XSS)

OpenEMR has Stored XSS in Graphical Pain Map legend via unescaped annotation text

• openemr
• Cross-site scripting (XSS)

OpenEMR has an Unauthenticated MedEx Token Disclosure

• openemr
• Authentication bypass

OpenEMR's payments gateway_api_key secret rendered into client JS code

• openemr
• Information disclosure

OpenEMR Arbitrary File Write leading to Remote Code Execution

• openemr
• Path traversal

OpenEMR's Portal Payment Endpoint Trusts User-Controlled pid

• openemr
• Broken access control

OpenEMR Vulnerable to Arbitrary File Exfiltration via Fax Endpoint

• openemr
• Path traversal

OpenEMR's Eye Exam View Trusts form_id Without Verifying Patient/Encounter Ownership

• openemr
• Broken access control

OpenEMR's Printable LBF Endpoint Leaks Arbitrary Patient Forms

• openemr
• Broken access control

OpenEMR Patient Picture Context Allows Arbitrary Patient Photo Retrieval

• openemr
• Broken access control

OpenEMR Missing Authorization Checks in DICOM Viewer State API

• openemr
• Broken access control

OpenEMR has SQL Injection Vulnerability

• openemr
• SQL injection

OpenEMR has Stored XSS in Questionnaire answers

• openemr
• Cross-site scripting (XSS)

OpenEMR has Session Timeout Bypass via skip_timeout_reset

• openemr
• Authentication bypass

OpenEMR Messages "Show All" Not Restricted to Admins

• openemr
• Broken access control

OpenEMR's Document and Insurance REST Endpoints Skip ACL

• openemr
• Broken access control

OpenEMR has SQL Injection in Patient API Sort Parameter

• openemr
• SQL injection

OpenEMR Portal Users Can Forge Provider Signatures

• openemr
• Broken access control

OpenEMR has FHIR Patient Compartment Bypass in CareTeam Resource

• openemr
• Information disclosure
• Broken access control

OpenEMR has SQL Injection in Immunization Search/Report

• openemr
• SQL injection

OpenEMR's location resource for Group.$export operation returns entire patient/user population contact information

• openemr
• Information disclosure

OpenEMR has Broken Access Control in Procedures Configuration

• openemr
• Broken access control

OpenEMR has Broken Access Control on Care Coordination Module

• openemr
• Broken access control

OpenEMR has Broken Access Control in Report/Clients/Message List CSV Export

• openemr
• Broken access control

OpenEMR has Broken Access Control that allows unauthorized access to EDI Logs

• openemr
• Broken access control

OpenEMR Arbitrary File Read Vulnerability

• openemr
• Path traversal

OpenEMR has Open Redirect in Eye Exam Form

• openemr
• Open redirect

OpenEMR allows inconsistent escaping of translation function output

• openemr
• CWE-116

OpenEMR has a Stored XSS in GAD-7 Form that Enables Session Hijacking and Privilege Escalation

• openemr
• Cross-site scripting (XSS)

OpenEMR allows links sent via Secure Messaging to be opened in OpenEMR and Portal

• openemr
• CWE-451

OpenEMR Has Disabled SSL Certificate Verification in HTTP Client

• openemr
• Weak cryptography or TLS

OpenEMR has Stored XSS in ub04 helper

• openemr
• Cross-site scripting (XSS)

OpenEMR Vulnerable to Broken Access Control in Profile Edit Endpoint

• openemr
• Broken access control

OpenEMR may expose Contents of Clinical Notes and Care Planto users who do not have Sensitivities=high privilege

• openemr
• Information disclosure

OpenEMR 5.0.2.1 - Remote Code Execution

• OpenEMR
• Cross-site scripting (XSS)

OpenEMR ≤ 4.1.1 SQL Injection Privilege Escalation and RCE

• OpenEMR
• SQL injection
• Unrestricted file upload

OpemEMR Vulnerable to Stored XSS Attack in the Additional Address Section of Patient Demographics

• openemr
• Cross-site scripting (XSS)

OpenEMR doesn't log password administration properly

• openemr
• CWE-778

OpenEMR Stored XSS via Patient Name Field in Procedure Orders

• openemr
• Cross-site scripting (XSS)

OpenEMR allows XSS in Patient Image feature

• openemr
• Cross-site scripting (XSS)

OpenEMR Out-of-Band Server-Side Request Forgery (OOB SSRF) Vulnerability

• openemr
• Server-side request forgery (SSRF)

OpenEMR Stored XSS in OpenEMR Bronchitis Form

• openemr
• Cross-site scripting (XSS)

OpenEMR Reflected XSS in AJAX Script

• openemr
• Cross-site scripting (XSS)

OpenEMR allows Reflected XSS in CAMOS new.php

• openemr
• Cross-site scripting (XSS)

OpenEMR Has Directory Traversal in Load Code feature

• openemr
• Path traversal

SQL injection in OpenEMR and others

• OpenEMR
• phpGACL
• SQL injection

openemr: In OpenEMR, versions 5.0.0 to 6.0.0.1 are vulnerable to weak password requirements as it…

• openemr

openemr: In OpenEMR, versions 4.2.0 to 6.0.0 are vulnerable to Reflected Cross-Site-Scripting…

• openemr

Cross-site scripting in openemr

• openemr
• Cross-site scripting (XSS)

Cross-site scripting in openemr

• openemr
• Cross-site scripting (XSS)

openemr: In OpenEMR, versions v2.7.2-rc1 to 6.0.0 are vulnerable to Improper Access Control when…

• openemr
• CWE-178

Cross-site scripting in openemr

• openemr
• Cross-site scripting (XSS)

Cross-site scripting in openemr

• openemr
• Cross-site scripting (XSS)