open-emr Openemr any version

Accounting User Can Download Patient Reports in openemr in openemr/openemr

Authorization Bypass Through User-Controlled Key in openemr/openemr

OpenEMR Vulnerable to Path Traversal When Zipping DICOM Folders

OpenEMR has IDOR in Portal Payment Page that Allows Cross-Patient Record Access

OpenEMR Patient Picture Context Allows Arbitrary Patient Photo Retrieval

OpenEMR's Printable LBF Endpoint Leaks Arbitrary Patient Forms

OpenEMR has Authorization Bypass in Dated Reminders Log

OpenEMR's Eye Exam View Trusts form_id Without Verifying Patient/Encounter Ownership

OpenEMR Vulnerable to Arbitrary File Exfiltration via Fax Endpoint

OpenEMR: POST /api/.../vital Accepts Attacker-Supplied id and Overwrites Arbitrary Vitals

OpenEMR's Message Update Ignores Patient id

OpenEMR has IDOR in Fee Sheet Product Save

OpenEMR has FHIR Patient Compartment Bypass in CareTeam Resource

OpenEMR has Broken Access Control in Report/Clients/Message List CSV Export

OpenEMR Messages "Show All" Not Restricted to Admins

OpenEMR has Broken Access Control that allows unauthorized access to EDI Logs

Cross-site Scripting (XSS) - Generic in openemr/openemr

OpenEMR Reflected XSS in AJAX Script

Cross-site Scripting (XSS) - Stored in openemr/openemr

Improper Access Control in openemr/openemr

In OpenEMR 5.0.1 and earlier, controller.php contains a reflected XSS vulnerability in the doc_id parameter. This could allow an attacker to execute arbitrary code in the context of a user's session.

In OpenEMR 5.0.1 and earlier, controller.php contains a reflected XSS vulnerability in the patient_id parameter. This could allow an attacker to execute arbitrary code in the context of a user's session.

Multiple reflected cross-site scripting (XSS) vulnerabilities in OpenEMR before 5.0.1 allow remote attackers to inject arbitrary web script or HTML via the (1) patient parameter to interface/main/finder/finder_navigation.php; (2) key parameter to interface/billing/get_claim_file.php; (3) formid or (4) formseq parameter to interface/orders/types.php; (5) eraname, (6) paydate, (7) post_to_date, (8) deposit_date, (9) debug, or (10) InsId parameter to interface/billing/sl_eob_process.php; (11) form_source, (12) form_paydate, (13) form_deposit_date, (14) form_amount, (15) form_name, (16) form_pid, (17) form_encounter, (18) form_date, or (19) form_to_date parameter to interface/billing/sl_eob_search.php; (20) codetype or (21) search_term parameter to interface/de_identification_forms/find_code_popup.php; (22) search_term parameter to interface/de_identification_forms/find_drug_popup.php; (23) search_term parameter to interface/de_identification_forms/find_immunization_popup.php; (24) id parameter to interface/forms/CAMOS/view.php; (25) id parameter to interface/forms/reviewofs/view.php; or (26) list_id parameter to library/custom_template/personalize.php.

Reflected XSS in interface/forms/eye_mag/view.php in OpenEMR 5.x before 5.0.2.1 allows a remote attacker to execute arbitrary code in the context of a user's session via the pid parameter.

In OpenEMR 5.0.1 and earlier, controller.php contains a reflected XSS vulnerability in the document_id parameter. This could allow an attacker to execute arbitrary code in the context of a user's session.

In OpenEMR 5.0.1 and earlier, controller.php contains a reflected XSS vulnerability in the foreign_id parameter. This could allow an attacker to execute arbitrary code in the context of a user's session.

A vulnerability in flashcanvas.swf in OpenEMR before 5.0.1 Patch 6 could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack on a targeted system.

Reflected XSS via Unescaped contextName Parameter in Custom Template Editor

4.1.0, 4.1.1, 4.1.2, 4.1.2.3, 4.1.2.6, 4.1.2.7, 4.2.0, 4.2.1, 4.2.2, 5.0.0, 5.0.0.5, 5.0.0.6, 5.0.1, 5.0.1.1, 5.0.1.2, 5.0.1.3, 5.0.1.4, 5.0.1.5, 5.0.1.6, 5.0.1.7, 5.0.2, fixed in version 5.0.2.1

In OpenEMR, versions 4.2.0 to 6.0.0 are vulnerable to Reflected Cross-Site-Scripting (XSS) due to user input not being validated properly. An attacker could trick a user to click on a malicious url and execute malicious code.

Reflected XSS exists in interface/forms/eye_mag/view.php in OpenEMR 5.x before 5.0.2.1 ia the id parameter.

Cross-site Scripting (XSS) - Reflected in openemr/openemr

OpenEMR has Open Redirect in Eye Exam Form

OpenEMR allows inconsistent escaping of translation function output

OpenEMR Vulnerable to SQL Injection via Unsanitized Variables in MedEx Recall/Reminder Processing

In OpenEMR, versions 2.7.3-rc1 to 6.0.0 are vulnerable to Stored Cross-Site-Scripting (XSS) due to user input not being validated properly in the `Allergies` section. An attacker could lure an admin to enter a malicious payload and by that initiate the exploit.

Non-Privilege User Can Created New Rule and Lead to Stored Cross Site Scripting in openemr/openemr

The application OpenEMR is affected by multiple reflected & stored Cross-Site Scripting (XSS) vulnerabilities affecting version 5.0.0 and prior versions. These vulnerabilities could allow remote authenticated attackers to inject arbitrary web script or HTML.

OpenEMR Vulnerable to Stored XSS via Unescaped portal_login_username in Credential Print View

OpenEMR: Dynamic Code Picker Renders Unescaped Descriptions (Stored XSS)