open-emr Openemr any version

OpenEMR has SQL Injection Vulnerability

Authorization Bypass Through User-Controlled Key in openemr/openemr

Authorization Bypass Through User-Controlled Key in openemr/openemr

OpenEMR Vulnerable to Authenticated Blind Boolean-Based SQL Injection in new_search_popup.php

OpenEMR has a SQL Injection Vulnerability in patient selection

OpenEMR has SQL Injection in CAMOS Form

Code Injection in openemr/openemr

Improper Access Control in openemr/openemr

SQL Injection Vulnerability in ajax graphs library (OpenEMR)

OpenEMR Missing Authorization on Claim File Download Endpoint

OpenEMR has Broken Access Control in Procedures Configuration

OpenEMR has a Stored XSS in GAD-7 Form that Enables Session Hijacking and Privilege Escalation

OpenEMR has stored XSS in portal_payment.php via Unescaped table_args

OpenEMR has Stored XSS in patient encounter Eye Exam form $CHRONIC2 and $CHRONIC3

OpenEMR: Stored XSS in prescription CSS/HTML print view via patient demographics

OpenEMR 8.2.0 OAuth2 Password Grant Authentication Bypass via SMART Configuration

OpenEMR Authenticated SQL Injection via backup.php Import Feature

OpenEMR has Stored XSS in patient encounter Eye Exam form answers

OpenEMR has Stored XSS in ub04 helper

OpenEMR Stored XSS in OpenEMR Bronchitis Form

Cross-site Scripting (XSS) - Generic in openemr/openemr

Cross-site Scripting (XSS) - Reflected in openemr/openemr

Data Access from Outside Expected Data Manager Component in openemr/openemr

Non-Privilege User Can View Patient’s Disclosures in openemr/openemr

Missing Authorization in openemr/openemr

Cross-site Scripting (XSS) - Reflected in openemr/openemr

In OpenEMR, versions 5.0.0 to 6.0.0.1 are vulnerable to weak password requirements as it does not enforce a maximum password length limit. If a malicious user is aware of the first 72 characters of the victim user’s password, he can leverage it to an account takeover.

Non Privilege User can Enable or Disable Registered in openemr/openemr

Improper Input Validation in openemr/openemr

The application OpenEMR version 5.0.0, 5.0.1-dev and prior is affected by vertical privilege escalation vulnerability. This vulnerability can allow an authenticated non-administrator users to view and modify information only accessible to administrators.

OpenEMR Missing Authorization in Procedure Order AJAX Deletion Handler

Improper Access Control in openemr/openemr

Improper Authorization in openemr/openemr

Improper Access Control in openemr/openemr

OpenEMR: Inverted ACL Condition in CDR ControllerRouter Allows Any Authenticated User to Modify/Delete Clinical Rules and Plans

OpenEMR has arbitrary image file read via PDF generator

OpenEMR: zhAclCheck Ignores Explicit ACL Denies

OpenEMR has IDOR in Patient Notes Web UI allows unauthorized note access/modification

OpenEMR's Document and Insurance REST Endpoints Skip ACL

OpenEMR Portal Users Can Forge Provider Signatures