Vulnerabilities (CVE)

Filtered by vendor Open-emr Subscribe
Filtered by product Openemr
Total 128 CVE
CVE Vendors Products Updated CVSS v2 CVSS v3
CVE-2019-3964 1 Open-emr 1 Openemr 2024-02-28 4.3 MEDIUM 6.1 MEDIUM
In OpenEMR 5.0.1 and earlier, controller.php contains a reflected XSS vulnerability in the doc_id parameter. This could allow an attacker to execute arbitrary code in the context of a user's session.
CVE-2019-14530 1 Open-emr 1 Openemr 2024-02-28 6.0 MEDIUM 8.8 HIGH
An issue was discovered in custom/ajax_download.php in OpenEMR before 5.0.2 via the fileName parameter. An attacker can download any file (that is readable by the user www-data) from server storage. If the requested file is writable for the www-data user and the directory /var/www/openemr/sites/default/documents/cqm_qrda/ exists, it will be deleted from server.
CVE-2018-17179 1 Open-emr 1 Openemr 2024-02-28 7.5 HIGH 9.8 CRITICAL
An issue was discovered in OpenEMR before 5.0.1 Patch 7. There is SQL Injection in the make_task function in /interface/forms/eye_mag/php/taskman_functions.php via /interface/forms/eye_mag/taskman.php.
CVE-2019-8368 1 Open-emr 1 Openemr 2024-02-28 4.3 MEDIUM 6.1 MEDIUM
OpenEMR v5.0.1-6 allows XSS.
CVE-2018-17181 1 Open-emr 1 Openemr 2024-02-28 7.5 HIGH 9.8 CRITICAL
An issue was discovered in OpenEMR before 5.0.1 Patch 7. SQL Injection exists in the SaveAudit function in /portal/lib/paylib.php and the portalAudit function in /portal/lib/appsql.class.php.
CVE-2019-3968 1 Open-emr 1 Openemr 2024-02-28 9.0 HIGH 8.8 HIGH
In OpenEMR 5.0.1 and earlier, an authenticated attacker can execute arbitrary commands on the host system via the Scanned Forms interface when creating a new form.
CVE-2019-14529 1 Open-emr 1 Openemr 2024-02-28 7.5 HIGH 9.8 CRITICAL
OpenEMR before 5.0.2 allows SQL Injection in interface/forms/eye_mag/save.php.
CVE-2019-3963 1 Open-emr 1 Openemr 2024-02-28 4.3 MEDIUM 6.1 MEDIUM
In OpenEMR 5.0.1 and earlier, controller.php contains a reflected XSS vulnerability in the patient_id parameter. This could allow an attacker to execute arbitrary code in the context of a user's session.
CVE-2019-8371 1 Open-emr 1 Openemr 2024-02-28 9.0 HIGH 7.2 HIGH
OpenEMR v5.0.1-6 allows code execution.
CVE-2018-15147 1 Open-emr 1 Openemr 2024-02-28 6.5 MEDIUM 8.8 HIGH
SQL injection vulnerability in interface/forms_admin/forms_admin.php from library/registry.inc in versions of OpenEMR before 5.0.1.4 allows a remote authenticated attacker to execute arbitrary SQL commands via the 'id' parameter.
CVE-2018-15143 1 Open-emr 1 Openemr 2024-02-28 7.5 HIGH 9.8 CRITICAL
Multiple SQL injection vulnerabilities in portal/find_appt_popup_user.php in versions of OpenEMR before 5.0.1.4 allow a remote attacker to execute arbitrary SQL commands via the (1) catid or (2) providerid parameter.
CVE-2018-15139 1 Open-emr 1 Openemr 2024-02-28 6.5 MEDIUM 8.8 HIGH
Unrestricted file upload in interface/super/manage_site_files.php in versions of OpenEMR before 5.0.1.4 allows a remote authenticated attacker to execute arbitrary PHP code by uploading a file with a PHP extension via the images upload form and accessing it in the images directory.
CVE-2018-15153 1 Open-emr 1 Openemr 2024-02-28 6.5 MEDIUM 8.8 HIGH
OS command injection occurring in versions of OpenEMR before 5.0.1.4 allows a remote authenticated attacker to execute arbitrary commands by making a crafted request to interface/main/daemon_frame.php after modifying the "hylafax_server" global variable in interface/super/edit_globals.php.
CVE-2018-1000218 1 Open-emr 1 Openemr 2024-02-28 3.5 LOW 5.4 MEDIUM
OpenEMR version v5_0_1_4 contains a Cross Site Scripting (XSS) vulnerability in The 'file' parameter in line #43 of interface/fax/fax_view.php that can result in The vulnerability could allow remote authenticated attackers to inject arbitrary web script or HTML.. This attack appear to be exploitable via The victim must visit on a specially crafted URL..
CVE-2018-15146 1 Open-emr 1 Openemr 2024-02-28 6.5 MEDIUM 8.8 HIGH
SQL injection vulnerability in interface/de_identification_forms/find_immunization_popup.php in versions of OpenEMR before 5.0.1.4 allows a remote authenticated attacker to execute arbitrary SQL commands via the 'search_term' parameter.
CVE-2018-15141 1 Open-emr 1 Openemr 2024-02-28 5.5 MEDIUM 6.5 MEDIUM
Directory traversal in portal/import_template.php in versions of OpenEMR before 5.0.1.4 allows a remote attacker authenticated in the patient portal to delete arbitrary files via the "docid" parameter when the mode is set to delete.
CVE-2018-15151 1 Open-emr 1 Openemr 2024-02-28 6.5 MEDIUM 8.8 HIGH
SQL injection vulnerability in interface/de_identification_forms/find_code_popup.php in versions of OpenEMR before 5.0.1.4 allows a remote authenticated attacker to execute arbitrary SQL commands via the 'search_term' parameter.
CVE-2018-15154 1 Open-emr 1 Openemr 2024-02-28 6.5 MEDIUM 8.8 HIGH
OS command injection occurring in versions of OpenEMR before 5.0.1.4 allows a remote authenticated attacker to execute arbitrary commands by making a crafted request to interface/billing/sl_eob_search.php after modifying the "print_command" global variable in interface/super/edit_globals.php.
CVE-2018-15144 1 Open-emr 1 Openemr 2024-02-28 6.5 MEDIUM 8.8 HIGH
SQL injection vulnerability in interface/de_identification_forms/find_drug_popup.php in versions of OpenEMR before 5.0.1.4 allows a remote authenticated attacker to execute arbitrary SQL commands via the search_term parameter.
CVE-2018-15148 1 Open-emr 1 Openemr 2024-02-28 6.5 MEDIUM 8.8 HIGH
SQL injection vulnerability in interface/patient_file/encounter/search_code.php in versions of OpenEMR before 5.0.1.4 allows a remote authenticated attacker to execute arbitrary SQL commands via the 'text' parameter.