Vulnerabilities (CVE)

Filtered by vendor Open-emr Subscribe
Filtered by product Openemr
Total 128 CVE
CVE Vendors Products Updated CVSS v2 CVSS v3
CVE-2023-22972 1 Open-emr 1 Openemr 2024-02-28 N/A 5.4 MEDIUM
A Reflected Cross-site scripting (XSS) vulnerability in interface/forms/eye_mag/php/eye_mag_functions.php in OpenEMR < 7.0.0 allows remote authenticated users to inject arbitrary web script or HTML via the REQUEST_URI.
CVE-2022-4504 1 Open-emr 1 Openemr 2024-02-28 N/A 7.5 HIGH
Improper Input Validation in GitHub repository openemr/openemr prior to 7.0.0.2.
CVE-2022-2824 1 Open-emr 1 Openemr 2024-02-28 N/A 5.4 MEDIUM
Authorization Bypass Through User-Controlled Key in GitHub repository openemr/openemr prior to 7.0.0.1.
CVE-2022-2730 1 Open-emr 1 Openemr 2024-02-28 N/A 6.5 MEDIUM
Authorization Bypass Through User-Controlled Key in GitHub repository openemr/openemr prior to 7.0.0.1.
CVE-2022-2732 1 Open-emr 1 Openemr 2024-02-28 N/A 8.3 HIGH
Missing Authorization in GitHub repository openemr/openemr prior to 7.0.0.1.
CVE-2022-2733 1 Open-emr 1 Openemr 2024-02-28 N/A 6.1 MEDIUM
Cross-site Scripting (XSS) - Reflected in GitHub repository openemr/openemr prior to 7.0.0.1.
CVE-2022-2734 1 Open-emr 1 Openemr 2024-02-28 N/A 5.4 MEDIUM
Improper Restriction of Rendered UI Layers or Frames in GitHub repository openemr/openemr prior to 7.0.0.1.
CVE-2022-2493 1 Open-emr 1 Openemr 2024-02-28 N/A 8.1 HIGH
Data Access from Outside Expected Data Manager Component in GitHub repository openemr/openemr prior to 7.0.0.
CVE-2022-2729 1 Open-emr 1 Openemr 2024-02-28 N/A 5.4 MEDIUM
Cross-site Scripting (XSS) - DOM in GitHub repository openemr/openemr prior to 7.0.0.1.
CVE-2022-2731 1 Open-emr 1 Openemr 2024-02-28 N/A 6.1 MEDIUM
Cross-site Scripting (XSS) - Reflected in GitHub repository openemr/openemr prior to 7.0.0.1.
CVE-2022-2494 1 Open-emr 1 Openemr 2024-02-28 N/A 5.4 MEDIUM
Cross-site Scripting (XSS) - Stored in GitHub repository openemr/openemr prior to 7.0.0.
CVE-2020-13567 2 Open-emr, Phpgacl Project 2 Openemr, Phpgacl 2024-02-28 7.5 HIGH 9.8 CRITICAL
Multiple SQL injection vulnerabilities exist in phpGACL 3.3.7. A specially crafted HTTP request can lead to a SQL injection. An attacker can send an HTTP request to trigger this vulnerability.
CVE-2022-1177 1 Open-emr 1 Openemr 2024-02-28 4.0 MEDIUM 4.3 MEDIUM
Accounting User Can Download Patient Reports in openemr in GitHub repository openemr/openemr prior to 6.1.0.
CVE-2022-1180 1 Open-emr 1 Openemr 2024-02-28 3.5 LOW 3.5 LOW
Reflected Cross Site Scripting in GitHub repository openemr/openemr prior to 6.0.0.4.
CVE-2022-1459 1 Open-emr 1 Openemr 2024-02-28 5.5 MEDIUM 8.3 HIGH
Non-Privilege User Can View Patient’s Disclosures in GitHub repository openemr/openemr prior to 6.1.0.1.
CVE-2022-1179 1 Open-emr 1 Openemr 2024-02-28 3.5 LOW 5.4 MEDIUM
Non-Privilege User Can Created New Rule and Lead to Stored Cross Site Scripting in GitHub repository openemr/openemr prior to 6.0.0.4.
CVE-2022-24643 1 Open-emr 1 Openemr 2024-02-28 3.5 LOW 5.4 MEDIUM
A stored cross-site scripting (XSS) issue was discovered in the OpenEMR Hospital Information Management System version 6.0.0.
CVE-2022-1181 1 Open-emr 1 Openemr 2024-02-28 3.5 LOW 5.4 MEDIUM
Stored Cross Site Scripting in GitHub repository openemr/openemr prior to 6.0.0.2.
CVE-2022-25471 1 Open-emr 1 Openemr 2024-02-28 5.5 MEDIUM 8.1 HIGH
An Insecure Direct Object Reference (IDOR) vulnerability in OpenEMR 6.0.0 allows any authenticated attacker to access and modify unauthorized areas via a crafted POST request to /modules/zend_modules/public/Installer/register.
CVE-2022-1178 1 Open-emr 1 Openemr 2024-02-28 3.5 LOW 5.4 MEDIUM
Stored Cross Site Scripting in GitHub repository openemr/openemr prior to 6.0.0.4.