open-emr Openemr any version

OpenEMR Has Disabled SSL Certificate Verification in HTTP Client

Stored Cross Site Scripting in openemr/openemr

OpenEMR: Stored DOM XSS via `.html()` in Portal Signer Modal

OpenEMR: XInclude Injection in CCDA Import Allows Reading Arbitrary Server Files

OpenEMR has a Privilege Escalation that Allows a Low-Level User to View Admin-Only Data

OpenEMR: Therapy Group Sensitivity ACL No Longer Enforced

OpemEMR Vulnerable to Stored XSS Attack in the Additional Address Section of Patient Demographics

OpenEMR Stored XSS via Patient Name Field in Procedure Orders

OpenEMR has Out-of-Band Server-Side Request Forgery (OOB SSRF)

OpenEMR has Stored XSS in CCDA Preview via Unsanitized linkHtml Attributes

SQL injection vulnerability in interface/login/validateUser.php in OpenEMR 4.1.0 and possibly earlier allows remote attackers to execute arbitrary SQL commands via the u parameter.

A Path Traversal in setup.php in OpenEMR < 7.0.0 allows remote unauthenticated users to read arbitrary files by controlling a connection to an attacker-controlled MySQL server.

OpenEMR before 5.0.0 Patch 5 allows unauthenticated remote database copying because setup.php exposes functionality for cloning an existing OpenEMR site to an arbitrary attacker-controlled MySQL server via vectors involving a crafted state parameter.

Improper Input Validation in openemr/openemr

OpenEMR Has Directory Traversal in Load Code feature

Cross-site Scripting (XSS) - Stored in openemr/openemr

OpenEMR Out-of-Band Server-Side Request Forgery (OOB SSRF) Vulnerability

OpenEMR has Session Timeout Bypass via skip_timeout_reset

Stored Cross Site Scripting in openemr/openemr

Stored XSS Leads To Session Hijacking in openemr/openemr

Cross-site Scripting (XSS) - Reflected in openemr/openemr

A SQL injection vulnerability in interface/reports/immunization_report.php in OpenEMR before 5.0.2.5 allows a remote authenticated attacker to execute arbitrary SQL commands via the form_code parameter.

A SQL injection vulnerability in interface/usergroup/usergroup_admin.php in OpenEMR before 5.0.2.5 allows a remote authenticated attacker to execute arbitrary SQL commands via the schedule_facility parameter when restrict_user_facility=on is in global settings.

A SQL injection vulnerability in interface/main/finder/patient_select.php from library/patient.inc in OpenEMR before 5.0.2.5 allows a remote authenticated attacker to execute arbitrary SQL commands via the searchFields parameter.

A SQL injection vulnerability in interface/reports/non_reported.php in OpenEMR before 5.0.2.5 allows a remote authenticated attacker to execute arbitrary SQL commands via the form_code parameter.

OpenEMR has Stored XSS in Questionnaire answers

OpenEMR has SQL Injection in PostCalendar Category Delete

OpenEMR allows Reflected XSS in CAMOS new.php

OpenEMR allows links sent via Secure Messaging to be opened in OpenEMR and Portal

OpenEMR Missing Authorization Checks in DICOM Viewer State API

OpenEMR's Portal Payment Endpoint Trusts User-Controlled pid

OpenEMR allows XSS in Patient Image feature

OpenEMR has Broken Access Control on Care Coordination Module

Cross-site Scripting (XSS) - Stored in openemr/openemr

In OpenEMR 5.0.1 and earlier, the patient file download interface contains a directory traversal flaw that allows authenticated attackers to download arbitrary files from the host system.

Directory traversal in portal/import_template.php in versions of OpenEMR before 5.0.1.4 allows a remote attacker authenticated in the patient portal to read arbitrary files via the "docid" parameter when the mode is set to get.

Directory traversal in portal/import_template.php in versions of OpenEMR before 5.0.1.4 allows a remote attacker authenticated in the patient portal to delete arbitrary files via the "docid" parameter when the mode is set to delete.

Multiple SQL injection vulnerabilities in OpenEMR 4.1.2 (Patch 7) and earlier allow remote authenticated users to execute arbitrary SQL commands via the (1) layout_id parameter to interface/super/edit_layout.php; (2) form_patient_id, (3) form_drug_name, or (4) form_lot_number parameter to interface/reports/prescriptions_report.php; (5) payment_id parameter to interface/billing/edit_payment.php; (6) id parameter to interface/forms_admin/forms_admin.php; (7) form_pid or (8) form_encounter parameter to interface/billing/sl_eob_search.php; (9) sortby parameter to interface/logview/logview.php; form_facility parameter to (10) procedure_stats.php, (11) pending_followup.php, or (12) pending_orders.php in interface/orders/; (13) patient, (14) encounterid, (15) formid, or (16) issue parameter to interface/patient_file/deleter.php; (17) search_term parameter to interface/patient_file/encounter/coding_popup.php; (18) text parameter to interface/patient_file/encounter/search_code.php; (19) form_addr1, (20) form_addr2, (21) form_attn, (22) form_country, (23) form_freeb_type, (24) form_partner, (25) form_name, (26) form_zip, (27) form_state, (28) form_city, or (29) form_cms_id parameter to interface/practice/ins_search.php; (30) form_pid parameter to interface/patient_file/problem_encounter.php; (31) patient, (32) form_provider, (33) form_apptstatus, or (34) form_facility parameter to interface/reports/appointments_report.php; (35) db_id parameter to interface/patient_file/summary/demographics_save.php; (36) p parameter to interface/fax/fax_dispatch_newpid.php; or (37) patient_id parameter to interface/patient_file/reminder/patient_reminders.php.

interface/patient_file/letter.php in OpenEMR before 5.0.1 allows remote authenticated users to bypass intended access restrictions via the newtemplatename and form_body parameters.

In OpenEMR, versions v2.7.2-rc1 to 6.0.0 are vulnerable to Improper Access Control when creating a new user, which leads to a malicious user able to read and send sensitive messages on behalf of the victim user.