open-emr openemr vulnerabilities, newest first, page 3
Filter
By year: all 2026 2025 2024 2023 2022 2021
- 8.5CVE-2025-67491EPSS 0.3%
OpenEMR is a free and open source electronic health records and medical practice management application. Versions 5.0.0.5 through 7.0.3.4 have a stored cross-site scripting vulnerability in the ub04 helper of the billing interface. The var…
- 8.8CVE-2025-67645EPSS 0.4%
OpenEMR is a free and open source electronic health records and medical practice management application. Versions prior to 7.0.4 have a broken access control in the Profile Edit endpoint. An authenticated normal user can modify the request…
- 7.1CVE-2025-54373EPSS 0.4%
OpenEMR is a free and open source electronic health records and medical practice management application. Versions prior to 7.0.4 have a vulnerability where sensitive data is unintentionally revealed to unauthorized parties. Contents of Cli…
- 4.8CVE-2021-47817EPSS 0.8%
OpenEMR 5.0.2.1 contains a cross-site scripting vulnerability in user profile parameters that authenticated attackers can chain with a file upload to achieve remote code execution. Attackers can exploit the vulnerability by crafting a mali…
- 8.7CVE-2013-10044ExploitEPSS 2.3%
An authenticated SQL injection vulnerability exists in OpenEMR ≤ 4.1.1 Patch 14 that allows a low-privileged attacker to extract administrator credentials and subsequently escalate privileges. Once elevated, the attacker can exploit an unr…
- 7.6CVE-2025-43860EPSS 15%
OpenEMR is a free and open source electronic health records and medical practice management application. A stored cross-site scripting (XSS) vulnerability in versions prior to 7.0.3.4 allows any authenticated user with patient creation and…
- 5.4CVE-2025-32967EPSS 0.3%
OpenEMR is a free and open source electronic health records and medical practice management application. A logging oversight in versions prior to 7.0.3.4 allows password change events to go unrecorded on the client-side log viewer, prevent…
- 7.6CVE-2025-32794EPSS 10%
OpenEMR is a free and open source electronic health records and medical practice management application. A stored cross-site scripting (XSS) vulnerability in versions prior to 7.0.3.4 allows any authenticated user with patient creation pri…
- 9.8CVE-2024-22611EPSS 6.3%
OpenEMR 7.0.2 is vulnerable to SQL Injection via \openemr\library\classes\Pharmacy.class.php, \controllers\C_Pharmacy.class.php and \openemr\controller.php.
- 7.0CVE-2025-31121EPSS 17%
OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 7.0.3.1, the Patient Image feature in OpenEMR is vulnerable to cross-site scripting attacks via the EXIF title in an image. T…
- 6.9CVE-2025-31117EPSS 0.5%
OpenEMR is a free and open source electronic health records and medical practice management application. An Out-of-Band Server-Side Request Forgery (OOB SSRF) vulnerability was identified in OpenEMR, allowing an attacker to force the serve…
- 8.4CVE-2025-30161EPSS 11%
OpenEMR is a free and open source electronic health records and medical practice management application. A stored XSS vulnerability in the Bronchitis form component of OpenEMR allows anyone who is able to edit a bronchitis form to steal cr…
- 4.6CVE-2025-30149EPSS 0.3%
OpenEMR is a free and open source electronic health records and medical practice management application. OpenEMR allows reflected cross-site scripting (XSS) in the AJAX Script interface\super\layout_listitems_ajax.php via the target parame…
- 7.2CVE-2025-29772EPSS 0.3%
OpenEMR is a free and open source electronic health records and medical practice management application. The POST parameter hidden_subcategory is output to the page without being properly processed. This leads to a reflected cross-site scr…
- 4.6CVE-2025-29789EPSS 0.9%
OpenEMR is a free and open source electronic health records and medical practice management application. Versions prior to 7.3.0 are vulnerable to Directory Traversal in the Load Code feature. Version 7.3.0 contains a patch for the issue.
- 4.8CVE-2024-0875EPSS 0.4%
A stored cross-site scripting (XSS) vulnerability exists in openemr/openemr version 7.0.1. An attacker can inject malicious payloads into the 'inputBody' field in the Secure Messaging feature, which can then be sent to other users. When th…
- 9.8CVE-2024-37734EPSS 0.8%
An issue in OpenEMR 7.0.2 allows a remote attacker to escalate privileges viaa crafted POST request using the noteid parameter.
- 3.5CVE-2024-26476EPSS 0.4%
An issue in open-emr before v.7.0.2 allows a remote attacker to escalate privileges via a crafted script to the formid parameter in the ereq_form.php component.
- 8.1CVE-2023-2950EPSS 0.6%
Improper Authorization in GitHub repository openemr/openemr prior to 7.0.1.
- 6.1CVE-2023-2949ExploitEPSS 1.5%
Cross-site Scripting (XSS) - Reflected in GitHub repository openemr/openemr prior to 7.0.1.
- 6.1CVE-2023-2948ExploitEPSS 97%
Cross-site Scripting (XSS) - Generic in GitHub repository openemr/openemr prior to 7.0.1.
- 4.8CVE-2023-2947EPSS 90%
Cross-site Scripting (XSS) - Stored in GitHub repository openemr/openemr prior to 7.0.1.
- 8.1CVE-2023-2946EPSS 0.5%
Improper Access Control in GitHub repository openemr/openemr prior to 7.0.1.
- 5.4CVE-2023-2945EPSS 0.4%
Missing Authorization in GitHub repository openemr/openemr prior to 7.0.1.
- 5.4CVE-2023-2944EPSS 0.4%
Improper Access Control in GitHub repository openemr/openemr prior to 7.0.1.
- 8.8CVE-2023-2943EPSS 0.6%
Code Injection in GitHub repository openemr/openemr prior to 7.0.1.
- 8.1CVE-2023-2942EPSS 0.8%
Improper Input Validation in GitHub repository openemr/openemr prior to 7.0.1.
- 4.3CVE-2023-2674EPSS 0.6%
Improper Access Control in GitHub repository openemr/openemr prior to 7.0.1.
- 4.8CVE-2023-2566EPSS 0.5%
Cross-site Scripting (XSS) - Stored in GitHub repository openemr/openemr prior to 7.0.1.
- 7.5CVE-2023-22974EPSS 1.9%
A Path Traversal in setup.php in OpenEMR < 7.0.0 allows remote unauthenticated users to read arbitrary files by controlling a connection to an attacker-controlled MySQL server.
- 8.8CVE-2023-22973EPSS 1.8%
A Local File Inclusion (LFI) vulnerability in interface/forms/LBF/new.php in OpenEMR < 7.0.0 allows remote authenticated users to execute code via the formname parameter.
- 5.4CVE-2023-22972EPSS 0.4%
A Reflected Cross-site scripting (XSS) vulnerability in interface/forms/eye_mag/php/eye_mag_functions.php in OpenEMR < 7.0.0 allows remote authenticated users to inject arbitrary web script or HTML via the REQUEST_URI.
- 4.8CVE-2022-4733EPSS 0.6%
Cross-site Scripting (XSS) - Stored in GitHub repository openemr/openemr prior to 7.0.0.2.
- 6.1CVE-2022-4615EPSS 0.7%
Cross-site Scripting (XSS) - Reflected in GitHub repository openemr/openemr prior to 7.0.0.2.
- 8.1CVE-2022-4567EPSS 0.6%
Improper Access Control in GitHub repository openemr/openemr prior to 7.0.0.2.
- 8.8CVE-2022-4506EPSS 1.1%
Unrestricted Upload of File with Dangerous Type in GitHub repository openemr/openemr prior to 7.0.0.2.
- 4.3CVE-2022-4505EPSS 0.7%
Authorization Bypass Through User-Controlled Key in GitHub repository openemr/openemr prior to 7.0.0.2.
- 7.5CVE-2022-4504EPSS 0.9%
Improper Input Validation in GitHub repository openemr/openemr prior to 7.0.0.2.
- 6.1CVE-2022-4503EPSS 0.6%
Cross-site Scripting (XSS) - Generic in GitHub repository openemr/openemr prior to 7.0.0.2.
- 6.1CVE-2022-4502EPSS 0.7%
Cross-site Scripting (XSS) - Reflected in GitHub repository openemr/openemr prior to 7.0.0.2.
- 5.4CVE-2022-2824EPSS 0.8%
Authorization Bypass Through User-Controlled Key in GitHub repository openemr/openemr prior to 7.0.0.1.
- 5.4CVE-2022-2734EPSS 0.8%
Improper Restriction of Rendered UI Layers or Frames in GitHub repository openemr/openemr prior to 7.0.0.1.
- 6.1CVE-2022-2733ExploitEPSS 96%
Cross-site Scripting (XSS) - Reflected in GitHub repository openemr/openemr prior to 7.0.0.1.
- 8.3CVE-2022-2732EPSS 1.0%
Missing Authorization in GitHub repository openemr/openemr prior to 7.0.0.1.
- 6.1CVE-2022-2731EPSS 0.6%
Cross-site Scripting (XSS) - Reflected in GitHub repository openemr/openemr prior to 7.0.0.1.
- 6.5CVE-2022-2730EPSS 0.8%
Authorization Bypass Through User-Controlled Key in GitHub repository openemr/openemr prior to 7.0.0.1.
- 5.4CVE-2022-2729EPSS 0.6%
Cross-site Scripting (XSS) - DOM in GitHub repository openemr/openemr prior to 7.0.0.1.
- 5.4CVE-2022-2494EPSS 0.7%
Cross-site Scripting (XSS) - Stored in GitHub repository openemr/openemr prior to 7.0.0.
- 8.1CVE-2022-2493EPSS 1.1%
Data Access from Outside Expected Data Manager Component in GitHub repository openemr/openemr prior to 7.0.0.
- 6.5CVE-2022-1461EPSS 0.9%
Non Privilege User can Enable or Disable Registered in GitHub repository openemr/openemr prior to 6.1.0.1.