agentprime: openemr

agentprime: openemrEvery new CVE for openemr.https://agentprime.io/CVE-2026-102940: OpenEMR: Missing Write ACL Allows Unauthorized Document Reassignmenthttps://agentprime.io/advisories/CVE-2026-102940/https://agentprime.io/advisories/CVE-2026-102940/CVSS 9.6 (Critical). Critical: CVSS score 9.6: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Thu, 05 Nov 2026 20:07:31 GMTCVEcriticalCVE-2026-103021: OpenEMR: Username Enumeration via Pre-Authentication User Settings Loadinghttps://agentprime.io/advisories/CVE-2026-103021/https://agentprime.io/advisories/CVE-2026-103021/CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Thu, 05 Nov 2026 20:06:36 GMTCVECVE-2026-103020: OpenEMR: Unauthenticated Information Disclosure in admin.php Exposes Database Names and Versionshttps://agentprime.io/advisories/CVE-2026-103020/https://agentprime.io/advisories/CVE-2026-103020/CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Thu, 05 Nov 2026 20:05:26 GMTCVECVE-2026-103019: OpenEMR: Unauthenticated Open Redirect via OIDC End Session Endpointhttps://agentprime.io/advisories/CVE-2026-103019/https://agentprime.io/advisories/CVE-2026-103019/CVSS 4.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Thu, 05 Nov 2026 20:04:25 GMTCVECVE-2026-104134: OpenEMR: Missing authorization in person-search AJAX leaks patient demographics (name, DOB, phone, email)https://agentprime.io/advisories/CVE-2026-104134/https://agentprime.io/advisories/CVE-2026-104134/CVSS 6.5 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Thu, 05 Nov 2026 20:03:37 GMTCVECVE-2026-103939: OpenEMR: Weno `file_download.php`: missing ACL/CSRF truncates the e-prescribing pharmacy directoryhttps://agentprime.io/advisories/CVE-2026-103939/https://agentprime.io/advisories/CVE-2026-103939/CVSS 5.4 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Thu, 05 Nov 2026 20:02:37 GMTCVECVE-2026-104138: OpenEMR: Missing authorization on QRDA Category I/III download endpointshttps://agentprime.io/advisories/CVE-2026-104138/https://agentprime.io/advisories/CVE-2026-104138/CVSS 6.5 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Thu, 05 Nov 2026 20:01:53 GMTCVECVE-2026-115573: OpenEMR: Broken Access Control in controller.php Enables Insurance Routing Credential Hijack and PHI Enumerationhttps://agentprime.io/advisories/CVE-2026-115573/https://agentprime.io/advisories/CVE-2026-115573/CVSS 8.1 (High). Published by the CVE Program. Not analysed by agentprime yet.Thu, 05 Nov 2026 20:01:06 GMTCVECVE-2026-104133: OpenEMR: Missing authorization in DORN `compendium_install.php` — non-admin destructive lab-compendium reinstallhttps://agentprime.io/advisories/CVE-2026-104133/https://agentprime.io/advisories/CVE-2026-104133/CVSS 7.1 (High). Published by the CVE Program. Not analysed by agentprime yet.Thu, 05 Nov 2026 20:00:19 GMTCVECVE-2026-103935: OpenEMR: Stored XSS via `text()` Misuse in Double-Quoted HTML Attributehttps://agentprime.io/advisories/CVE-2026-103935/https://agentprime.io/advisories/CVE-2026-103935/CVSS 8.1 (High). Published by the CVE Program. Not analysed by agentprime yet.Thu, 05 Nov 2026 19:59:37 GMTCVECVE-2026-104135: OpenEMR: Missing authorization in payment patient-search AJAX leaks patient directory and dates of birthhttps://agentprime.io/advisories/CVE-2026-104135/https://agentprime.io/advisories/CVE-2026-104135/CVSS 6.5 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Thu, 05 Nov 2026 19:58:44 GMTCVECVE-2026-104136: OpenEMR: Arbitrary Patient Recall and Contact Detail Readhttps://agentprime.io/advisories/CVE-2026-104136/https://agentprime.io/advisories/CVE-2026-104136/CVSS 7.1 (High). Published by the CVE Program. Not analysed by agentprime yet.Thu, 05 Nov 2026 19:57:53 GMTCVECVE-2026-103938: OpenEMR: CSRF Protection Bypass on IPPF Point-of-Sale Void and Regen Operationshttps://agentprime.io/advisories/CVE-2026-103938/https://agentprime.io/advisories/CVE-2026-103938/CVSS 7.1 (High). Published by the CVE Program. Not analysed by agentprime yet.Thu, 05 Nov 2026 19:56:59 GMTCVECVE-2026-104137: OpenEMR: Patient Data Search Without Sufficient ACLhttps://agentprime.io/advisories/CVE-2026-104137/https://agentprime.io/advisories/CVE-2026-104137/CVSS 7.1 (High). Published by the CVE Program. Not analysed by agentprime yet.Thu, 05 Nov 2026 19:56:13 GMTCVECVE-2026-104139: OpenEMR: Missing Authorization on Document Template Download Endpoint Allows Any Authenticated User to Read Another Patient's PHIhttps://agentprime.io/advisories/CVE-2026-104139/https://agentprime.io/advisories/CVE-2026-104139/CVSS 6.5 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Thu, 05 Nov 2026 19:55:24 GMTCVECVE-2026-65983: OpenEMR FaxSMS module: insecure staging of decrypted patient documents in webroothttps://agentprime.io/advisories/CVE-2026-65983/https://agentprime.io/advisories/CVE-2026-65983/CVSS 7.5 (High). Published by the CVE Program. Not analysed by agentprime yet.Thu, 05 Nov 2026 19:52:57 GMTCVECVE-2026-49142: OpenEMR Before 8.5.0 SQL Injection via form_icd_codes[]https://agentprime.io/advisories/CVE-2026-49142/https://agentprime.io/advisories/CVE-2026-49142/CVSS 8.7 (High). Published by the CVE Program. Not analysed by agentprime yet.Thu, 29 Oct 2026 12:37:16 GMTCVECVE-2026-76614: OpenEMR < 8.3.0 Path Traversal Information Disclosure via EDI Archive Restorehttps://agentprime.io/advisories/CVE-2026-76614/https://agentprime.io/advisories/CVE-2026-76614/CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Wed, 19 Aug 2026 14:55:56 GMTCVECVE-2026-40509: OpenEMR < 8.3.0 CSRF via DICOM Viewer web_path Parameterhttps://agentprime.io/advisories/CVE-2026-40509/https://agentprime.io/advisories/CVE-2026-40509/CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Wed, 19 Aug 2026 14:53:21 GMTCVECVE-2026-40508: OpenEMR < 8.3.0 Stored XSS via Patient Portal Template Import Handlerhttps://agentprime.io/advisories/CVE-2026-40508/https://agentprime.io/advisories/CVE-2026-40508/CVSS 5.1 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Wed, 19 Aug 2026 14:51:01 GMTCVECVE-2026-40507: OpenEMR < 8.3.0 Reflected XSS via templateHtml Parameter in Patient Portalhttps://agentprime.io/advisories/CVE-2026-40507/https://agentprime.io/advisories/CVE-2026-40507/CVSS 5.1 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Wed, 19 Aug 2026 14:48:49 GMTCVECVE-2026-40506: OpenEMR Path Traversal Arbitrary Directory Deletion via standard_tables_manage.phphttps://agentprime.io/advisories/CVE-2026-40506/https://agentprime.io/advisories/CVE-2026-40506/CVSS 7.0 (High). Published by the CVE Program. Not analysed by agentprime yet.Mon, 17 Aug 2026 20:39:03 GMTCVECVE-2026-67612: OpenEMR 8.2.0 Stored XSS via import_template.php Template Managementhttps://agentprime.io/advisories/CVE-2026-67612/https://agentprime.io/advisories/CVE-2026-67612/CVSS 4.8 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Mon, 03 Aug 2026 16:06:15 GMTCVECVE-2026-67611: OpenEMR 8.2.0 OAuth2 Password Grant Authentication Bypass via SMART Configurationhttps://agentprime.io/advisories/CVE-2026-67611/https://agentprime.io/advisories/CVE-2026-67611/CVSS 8.6 (High). Published by the CVE Program. Not analysed by agentprime yet.Mon, 03 Aug 2026 16:04:34 GMTCVECVE-2026-67610: OpenEMR 8.2.0 OAuth2 Dynamic Client Registration Unauthorized FHIR Accesshttps://agentprime.io/advisories/CVE-2026-67610/https://agentprime.io/advisories/CVE-2026-67610/CVSS 8.6 (High). Published by the CVE Program. Not analysed by agentprime yet.Mon, 03 Aug 2026 16:02:47 GMTCVECVE-2026-39932: OpenEMR 8.2.0 Remote Code Execution via CategoryTree eval() Injectionhttps://agentprime.io/advisories/CVE-2026-39932/https://agentprime.io/advisories/CVE-2026-39932/CVSS 9.4 (Critical). Critical: CVSS score 9.4: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Mon, 03 Aug 2026 16:00:09 GMTCVEcriticalCVE-2026-39931: OpenEMR Authenticated SQL Injection via backup.php Import Featurehttps://agentprime.io/advisories/CVE-2026-39931/https://agentprime.io/advisories/CVE-2026-39931/CVSS 8.6 (High). Published by the CVE Program. Not analysed by agentprime yet.Mon, 03 Aug 2026 15:54:13 GMTCVECVE-2026-46518: OpenEMR: Stored XSS in prescription CSS/HTML print view via patient demographicshttps://agentprime.io/advisories/CVE-2026-46518/https://agentprime.io/advisories/CVE-2026-46518/CVSS 7.7 (High). Published by the CVE Program. Not analysed by agentprime yet.Tue, 09 Jun 2026 22:50:49 GMTCVECVE-2026-34056: OpenEMR has a Privilege Escalation that Allows a Low-Level User to View Admin-Only Datahttps://agentprime.io/advisories/CVE-2026-34056/https://agentprime.io/advisories/CVE-2026-34056/CVSS 7.7 (High). Published by the CVE Program. Not analysed by agentprime yet.Wed, 25 Mar 2026 23:53:15 GMTCVECVE-2026-34055: OpenEMR has IDOR in Patient Notes Web UI allows unauthorized note access/modificationhttps://agentprime.io/advisories/CVE-2026-34055/https://agentprime.io/advisories/CVE-2026-34055/CVSS 8.1 (High). Published by the CVE Program. Not analysed by agentprime yet.Wed, 25 Mar 2026 23:49:06 GMTCVECVE-2026-34053: OpenEMR Missing Authorization in Procedure Order AJAX Deletion Handlerhttps://agentprime.io/advisories/CVE-2026-34053/https://agentprime.io/advisories/CVE-2026-34053/CVSS 7.1 (High). Published by the CVE Program. Not analysed by agentprime yet.Wed, 25 Mar 2026 23:46:21 GMTCVECVE-2026-34051: OpenEMR has Improper ACL On Import/Export Popuphttps://agentprime.io/advisories/CVE-2026-34051/https://agentprime.io/advisories/CVE-2026-34051/CVSS 5.4 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Wed, 25 Mar 2026 23:45:06 GMTCVECVE-2026-33934: OpenEMR's Missing Authorization in show-signature.php Allows Portal Patients to Read Staff Signatureshttps://agentprime.io/advisories/CVE-2026-33934/https://agentprime.io/advisories/CVE-2026-33934/CVSS 4.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Wed, 25 Mar 2026 23:41:51 GMTCVECVE-2026-33933: Reflected XSS via Unescaped contextName Parameter in Custom Template Editorhttps://agentprime.io/advisories/CVE-2026-33933/https://agentprime.io/advisories/CVE-2026-33933/CVSS 6.1 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Wed, 25 Mar 2026 23:40:16 GMTCVECVE-2026-33932: OpenEMR has Stored XSS in CCDA Preview via Unsanitized linkHtml Attributeshttps://agentprime.io/advisories/CVE-2026-33932/https://agentprime.io/advisories/CVE-2026-33932/CVSS 7.6 (High). Published by the CVE Program. Not analysed by agentprime yet.Wed, 25 Mar 2026 23:37:58 GMTCVECVE-2026-33931: OpenEMR has IDOR in Portal Payment Page that Allows Cross-Patient Record Accesshttps://agentprime.io/advisories/CVE-2026-33931/https://agentprime.io/advisories/CVE-2026-33931/CVSS 6.5 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Wed, 25 Mar 2026 23:36:48 GMTCVECVE-2026-33918: OpenEMR Missing Authorization on Claim File Download Endpointhttps://agentprime.io/advisories/CVE-2026-33918/https://agentprime.io/advisories/CVE-2026-33918/CVSS 7.6 (High). Published by the CVE Program. Not analysed by agentprime yet.Wed, 25 Mar 2026 23:35:06 GMTCVECVE-2026-33917: OpenEMR has SQL Injection in CAMOS Formhttps://agentprime.io/advisories/CVE-2026-33917/https://agentprime.io/advisories/CVE-2026-33917/CVSS 8.8 (High). Published by the CVE Program. Not analysed by agentprime yet.Wed, 25 Mar 2026 23:31:20 GMTCVECVE-2026-33915: OpenEMR Missing ACL Checks on Insurance Company API Routeshttps://agentprime.io/advisories/CVE-2026-33915/https://agentprime.io/advisories/CVE-2026-33915/CVSS 5.4 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Wed, 25 Mar 2026 23:23:40 GMTCVECVE-2026-33914: OpenEMR has SQL Injection in PostCalendar Category Deletehttps://agentprime.io/advisories/CVE-2026-33914/https://agentprime.io/advisories/CVE-2026-33914/CVSS 7.2 (High). Published by the CVE Program. Not analysed by agentprime yet.Wed, 25 Mar 2026 23:13:16 GMTCVECVE-2026-33913: OpenEMR: XInclude Injection in CCDA Import Allows Reading Arbitrary Server Fileshttps://agentprime.io/advisories/CVE-2026-33913/https://agentprime.io/advisories/CVE-2026-33913/CVSS 7.7 (High). Published by the CVE Program. Not analysed by agentprime yet.Wed, 25 Mar 2026 22:52:50 GMTCVECVE-2026-33912: OpenEMR has reflected XSS in ajax_download.php via reportID parameterhttps://agentprime.io/advisories/CVE-2026-33912/https://agentprime.io/advisories/CVE-2026-33912/CVSS 5.4 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Wed, 25 Mar 2026 22:51:15 GMTCVECVE-2026-33911: OpenEMR vulnerable to reflected XSS in graphs.php via title parameterhttps://agentprime.io/advisories/CVE-2026-33911/https://agentprime.io/advisories/CVE-2026-33911/CVSS 5.4 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Wed, 25 Mar 2026 22:44:13 GMTCVECVE-2026-33910: OpenEMR has a SQL Injection Vulnerability in patient selectionhttps://agentprime.io/advisories/CVE-2026-33910/https://agentprime.io/advisories/CVE-2026-33910/CVSS 7.2 (High). Published by the CVE Program. Not analysed by agentprime yet.Wed, 25 Mar 2026 22:41:02 GMTCVECVE-2026-33909: OpenEMR Vulnerable to SQL Injection via Unsanitized Variables in MedEx Recall/Reminder Processinghttps://agentprime.io/advisories/CVE-2026-33909/https://agentprime.io/advisories/CVE-2026-33909/CVSS 5.9 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Wed, 25 Mar 2026 22:35:29 GMTCVECVE-2026-33348: OpenEMR has Stored XSS in patient encounter Eye Exam form $CHRONIC2 and $CHRONIC3https://agentprime.io/advisories/CVE-2026-33348/https://agentprime.io/advisories/CVE-2026-33348/CVSS 8.7 (High). Published by the CVE Program. Not analysed by agentprime yet.Wed, 25 Mar 2026 22:30:37 GMTCVECVE-2026-32120: OpenEMR has IDOR in Fee Sheet Product Savehttps://agentprime.io/advisories/CVE-2026-32120/https://agentprime.io/advisories/CVE-2026-32120/CVSS 6.5 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Wed, 25 Mar 2026 22:27:38 GMTCVECVE-2026-29187: OpenEMR Vulnerable to Authenticated Blind Boolean-Based SQL Injection in new_search_popup.phphttps://agentprime.io/advisories/CVE-2026-29187/https://agentprime.io/advisories/CVE-2026-29187/CVSS 8.1 (High). Published by the CVE Program. Not analysed by agentprime yet.Wed, 25 Mar 2026 22:24:24 GMTCVECVE-2026-33346: OpenEMR has stored XSS in portal_payment.php via Unescaped table_argshttps://agentprime.io/advisories/CVE-2026-33346/https://agentprime.io/advisories/CVE-2026-33346/CVSS 8.7 (High). Published by the CVE Program. Not analysed by agentprime yet.Thu, 19 Mar 2026 20:33:10 GMTCVECVE-2026-33305: OpenEMR has Authorization Bypass in FaxSMS AppDispatch Constructorhttps://agentprime.io/advisories/CVE-2026-33305/https://agentprime.io/advisories/CVE-2026-33305/CVSS 5.4 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Thu, 19 Mar 2026 20:30:57 GMTCVE