open-emr Openemr

Data Access from Outside Expected Data Manager Component in openemr/openemr

Non-Privilege User Can View Patient’s Disclosures in openemr/openemr

Missing Authorization in openemr/openemr

Cross-site Scripting (XSS) - Reflected in openemr/openemr

The Patient Portal of OpenEMR 5.0.2.1 is affected by a incorrect access control system in portal/patient/_machine_config.php. To exploit the vulnerability, an unauthenticated attacker can register an account, bypassing the permission check of this portal's API. Then, the attacker can then manipulate and read data of every registered patient.

In OpenEMR, versions 5.0.0 to 6.0.0.1 are vulnerable to weak password requirements as it does not enforce a maximum password length limit. If a malicious user is aware of the first 72 characters of the victim user’s password, he can leverage it to an account takeover.

Non Privilege User can Enable or Disable Registered in openemr/openemr

An Insecure Direct Object Reference (IDOR) vulnerability in OpenEMR 6.0.0 allows any authenticated attacker to access and modify unauthorized areas via a crafted POST request to /modules/zend_modules/public/Installer/register.

Improper Input Validation in openemr/openemr

The application OpenEMR version 5.0.0, 5.0.1-dev and prior is affected by vertical privilege escalation vulnerability. This vulnerability can allow an authenticated non-administrator users to view and modify information only accessible to administrators.

OpenEMR Missing Authorization in Procedure Order AJAX Deletion Handler

Improper Access Control in openemr/openemr

Improper Authorization in openemr/openemr

Improper Access Control in openemr/openemr

OpenEMR: Inverted ACL Condition in CDR ControllerRouter Allows Any Authenticated User to Modify/Delete Clinical Rules and Plans

OpenEMR has arbitrary image file read via PDF generator

Stored XSS in openemr/openemr

OpenEMR: zhAclCheck Ignores Explicit ACL Denies

OpenEMR has IDOR in Patient Notes Web UI allows unauthorized note access/modification

OpenEMR's Document and Insurance REST Endpoints Skip ACL

OpenEMR Portal Users Can Forge Provider Signatures

OpenEMR Has Disabled SSL Certificate Verification in HTTP Client

Stored Cross Site Scripting in openemr/openemr

OpenEMR: Stored DOM XSS via `.html()` in Portal Signer Modal

OpenEMR: XInclude Injection in CCDA Import Allows Reading Arbitrary Server Files

OpenEMR has a Privilege Escalation that Allows a Low-Level User to View Admin-Only Data

OpenEMR: Therapy Group Sensitivity ACL No Longer Enforced

OpemEMR Vulnerable to Stored XSS Attack in the Additional Address Section of Patient Demographics

OpenEMR Stored XSS via Patient Name Field in Procedure Orders

OpenEMR has Out-of-Band Server-Side Request Forgery (OOB SSRF)

OpenEMR has Stored XSS in CCDA Preview via Unsanitized linkHtml Attributes

SQL injection vulnerability in interface/login/validateUser.php in OpenEMR 4.1.0 and possibly earlier allows remote attackers to execute arbitrary SQL commands via the u parameter.

A Path Traversal in setup.php in OpenEMR < 7.0.0 allows remote unauthenticated users to read arbitrary files by controlling a connection to an attacker-controlled MySQL server.

OpenEMR before 5.0.0 Patch 5 allows unauthenticated remote database copying because setup.php exposes functionality for cloning an existing OpenEMR site to an arbitrary attacker-controlled MySQL server via vectors involving a crafted state parameter.

The csv_log_html function in library/edihistory/edih_csv_inc.php in OpenEMR 5.0.0 and prior allows attackers to bypass intended access restrictions via a crafted name.

Improper Input Validation in openemr/openemr

OpenEMR Has Directory Traversal in Load Code feature

Cross-site Scripting (XSS) - Stored in openemr/openemr

OpenEMR Out-of-Band Server-Side Request Forgery (OOB SSRF) Vulnerability

OpenEMR has Session Timeout Bypass via skip_timeout_reset