Filtered by vendor Open-emr
Subscriptions
Filtered by product Openemr
Subscriptions
Total
128 CVE
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2020-19364 | 1 Open-emr | 1 Openemr | 2021-01-22 | 8.8 High |
| OpenEMR 5.0.1 allows an authenticated attacker to upload and execute malicious PHP scripts through /controller.php. | ||||
| CVE-2018-16795 | 1 Open-emr | 1 Openemr | 2021-01-05 | 8.8 High |
| OpenEMR 5.0.1.3 allows Cross-Site Request Forgery (CSRF) via library/ajax and interface/super, as demonstrated by use of interface/super/manage_site_files.php to upload a .php file. | ||||
| CVE-2019-3968 | 1 Open-emr | 1 Openemr | 2020-08-24 | N/A |
| In OpenEMR 5.0.1 and earlier, an authenticated attacker can execute arbitrary commands on the host system via the Scanned Forms interface when creating a new form. | ||||
| CVE-2017-6394 | 1 Open-emr | 1 Openemr | 2020-07-10 | 6.1 Medium |
| Multiple Cross-Site Scripting (XSS) issues were discovered in OpenEMR 5.0.0 and 5.0.1-dev. The vulnerabilities exist due to insufficient filtration of user-supplied data passed to the "openemr-master/gacl/admin/object_search.php" URL (section_value; src_form). An attacker could execute arbitrary HTML and script code in a browser in the context of the vulnerable website. | ||||
| CVE-2018-18035 | 1 Open-emr | 1 Openemr | 2020-01-23 | N/A |
| A vulnerability in flashcanvas.swf in OpenEMR before 5.0.1 Patch 6 could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack on a targeted system. | ||||
| CVE-2019-16404 | 1 Open-emr | 1 Openemr | 2019-10-22 | 8.8 High |
| Authenticated SQL Injection in interface/forms/eye_mag/js/eye_base.php in OpenEMR through 5.0.2 allows a user to extract arbitrary data from the openemr database via a non-parameterized INSERT INTO statement, as demonstrated by the providerID parameter. | ||||
| CVE-2019-17409 | 1 Open-emr | 1 Openemr | 2019-10-21 | 6.1 Medium |
| Reflected XSS exists in interface/forms/eye_mag/view.php in OpenEMR 5.x before 5.0.2.1 ia the id parameter. | ||||
| CVE-2019-16862 | 1 Open-emr | 1 Openemr | 2019-10-21 | 6.1 Medium |
| Reflected XSS in interface/forms/eye_mag/view.php in OpenEMR 5.x before 5.0.2.1 allows a remote attacker to execute arbitrary code in the context of a user's session via the pid parameter. | ||||
| CVE-2019-17179 | 1 Open-emr | 1 Openemr | 2019-10-21 | 6.1 Medium |
| 4.1.0, 4.1.1, 4.1.2, 4.1.2.3, 4.1.2.6, 4.1.2.7, 4.2.0, 4.2.1, 4.2.2, 5.0.0, 5.0.0.5, 5.0.0.6, 5.0.1, 5.0.1.1, 5.0.1.2, 5.0.1.3, 5.0.1.4, 5.0.1.5, 5.0.1.6, 5.0.1.7, 5.0.2, fixed in version 5.0.2.1 | ||||
| CVE-2019-17197 | 1 Open-emr | 1 Openemr | 2019-10-08 | 9.8 Critical |
| OpenEMR through 5.0.2 has SQL Injection in the Lifestyle demographic filter criteria in library/clinical_rules.php that affects library/patient.inc. | ||||
| CVE-2018-10573 | 1 Open-emr | 1 Openemr | 2019-10-03 | N/A |
| interface/fax/fax_dispatch.php in OpenEMR before 5.0.1 allows remote authenticated users to bypass intended access restrictions via the scan parameter. | ||||
| CVE-2017-12064 | 1 Open-emr | 1 Openemr | 2019-10-03 | N/A |
| The csv_log_html function in library/edihistory/edih_csv_inc.php in OpenEMR 5.0.0 and prior allows attackers to bypass intended access restrictions via a crafted name. | ||||
| CVE-2018-10572 | 1 Open-emr | 1 Openemr | 2019-10-03 | N/A |
| interface/patient_file/letter.php in OpenEMR before 5.0.1 allows remote authenticated users to bypass intended access restrictions via the newtemplatename and form_body parameters. | ||||
| CVE-2019-8368 | 1 Open-emr | 1 Openemr | 2019-09-16 | 6.1 Medium |
| OpenEMR v5.0.1-6 allows XSS. | ||||
| CVE-2019-3967 | 1 Open-emr | 1 Openemr | 2019-08-27 | N/A |
| In OpenEMR 5.0.1 and earlier, the patient file download interface contains a directory traversal flaw that allows authenticated attackers to download arbitrary files from the host system. | ||||
| CVE-2019-3966 | 1 Open-emr | 1 Openemr | 2019-08-26 | N/A |
| In OpenEMR 5.0.1 and earlier, controller.php contains a reflected XSS vulnerability in the foreign_id parameter. This could allow an attacker to execute arbitrary code in the context of a user's session. | ||||
| CVE-2019-3965 | 1 Open-emr | 1 Openemr | 2019-08-22 | N/A |
| In OpenEMR 5.0.1 and earlier, controller.php contains a reflected XSS vulnerability in the document_id parameter. This could allow an attacker to execute arbitrary code in the context of a user's session. | ||||
| CVE-2019-3963 | 1 Open-emr | 1 Openemr | 2019-08-22 | N/A |
| In OpenEMR 5.0.1 and earlier, controller.php contains a reflected XSS vulnerability in the patient_id parameter. This could allow an attacker to execute arbitrary code in the context of a user's session. | ||||
| CVE-2019-3964 | 1 Open-emr | 1 Openemr | 2019-08-22 | N/A |
| In OpenEMR 5.0.1 and earlier, controller.php contains a reflected XSS vulnerability in the doc_id parameter. This could allow an attacker to execute arbitrary code in the context of a user's session. | ||||
| CVE-2018-17181 | 1 Open-emr | 1 Openemr | 2019-05-20 | N/A |
| An issue was discovered in OpenEMR before 5.0.1 Patch 7. SQL Injection exists in the SaveAudit function in /portal/lib/paylib.php and the portalAudit function in /portal/lib/appsql.class.php. | ||||