CVE-2013-10044

8.7 highEPSS 2.1%

High (8.7) in open-emr openemr. EPSS 2.1% chance of exploitation in the next 30 days.

An authenticated SQL injection vulnerability exists in OpenEMR ≤ 4.1.1 Patch 14 that allows a low-privileged attacker to extract administrator credentials and subsequently escalate privileges. Once elevated, the attacker can exploit an unrestricted file upload flaw to achieve remote code execution, resulting in full compromise of the application and its host system.

Severity

CVSS 4.0

8.7 high

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

CVSS 3.1

8.8 high

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS: 2.1% chance of exploitation in the next 30 days; higher than 81% of CVEs (scores of 2026-10-31)
CWEs: CWE-434, CWE-89
Published: 2025-08-01
Modified: 2026-06-16
Record from: the NVD, synced 2026-10-19

Affected

open-emr:openemr

References

https://github.com/openemr/openemr
https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/unix/webapp/openemr_sqli_privesc_upload.rb
https://www.exploit-db.com/exploits/28329
https://www.exploit-db.com/exploits/28408
https://www.open-emr.org/

Check your stack JSON