cve.bz

open-emr openemr vulnerabilities in 2022, newest first

Filter

By year: all 2026 2025 2024 2023 2022 2021

  1. 4.8CVE-2022-4733EPSS 0.6%

    Cross-site Scripting (XSS) - Stored in GitHub repository openemr/openemr prior to 7.0.0.2.

  2. 6.1CVE-2022-4615EPSS 0.7%

    Cross-site Scripting (XSS) - Reflected in GitHub repository openemr/openemr prior to 7.0.0.2.

  3. 8.1CVE-2022-4567EPSS 0.6%

    Improper Access Control in GitHub repository openemr/openemr prior to 7.0.0.2.

  4. 8.8CVE-2022-4506EPSS 1.1%

    Unrestricted Upload of File with Dangerous Type in GitHub repository openemr/openemr prior to 7.0.0.2.

  5. 4.3CVE-2022-4505EPSS 0.7%

    Authorization Bypass Through User-Controlled Key in GitHub repository openemr/openemr prior to 7.0.0.2.

  6. 7.5CVE-2022-4504EPSS 0.9%

    Improper Input Validation in GitHub repository openemr/openemr prior to 7.0.0.2.

  7. 6.1CVE-2022-4503EPSS 0.6%

    Cross-site Scripting (XSS) - Generic in GitHub repository openemr/openemr prior to 7.0.0.2.

  8. 6.1CVE-2022-4502EPSS 0.7%

    Cross-site Scripting (XSS) - Reflected in GitHub repository openemr/openemr prior to 7.0.0.2.

  9. 5.4CVE-2022-2824EPSS 0.8%

    Authorization Bypass Through User-Controlled Key in GitHub repository openemr/openemr prior to 7.0.0.1.

  10. 5.4CVE-2022-2734EPSS 0.8%

    Improper Restriction of Rendered UI Layers or Frames in GitHub repository openemr/openemr prior to 7.0.0.1.

  11. 6.1CVE-2022-2733ExploitEPSS 96%

    Cross-site Scripting (XSS) - Reflected in GitHub repository openemr/openemr prior to 7.0.0.1.

  12. 8.3CVE-2022-2732EPSS 1.0%

    Missing Authorization in GitHub repository openemr/openemr prior to 7.0.0.1.

  13. 6.1CVE-2022-2731EPSS 0.6%

    Cross-site Scripting (XSS) - Reflected in GitHub repository openemr/openemr prior to 7.0.0.1.

  14. 6.5CVE-2022-2730EPSS 0.8%

    Authorization Bypass Through User-Controlled Key in GitHub repository openemr/openemr prior to 7.0.0.1.

  15. 5.4CVE-2022-2729EPSS 0.6%

    Cross-site Scripting (XSS) - DOM in GitHub repository openemr/openemr prior to 7.0.0.1.

  16. 5.4CVE-2022-2494EPSS 0.7%

    Cross-site Scripting (XSS) - Stored in GitHub repository openemr/openemr prior to 7.0.0.

  17. 8.1CVE-2022-2493EPSS 1.1%

    Data Access from Outside Expected Data Manager Component in GitHub repository openemr/openemr prior to 7.0.0.

  18. 6.5CVE-2022-1461EPSS 0.9%

    Non Privilege User can Enable or Disable Registered in GitHub repository openemr/openemr prior to 6.1.0.1.

  19. 8.3CVE-2022-1459EPSS 1.1%

    Non-Privilege User Can View Patient’s Disclosures in GitHub repository openemr/openemr prior to 6.1.0.1.

  20. 5.4CVE-2022-1458EPSS 0.7%

    Stored XSS Leads To Session Hijacking in GitHub repository openemr/openemr prior to 6.1.0.1.

  21. 9.8CVE-2020-13567EPSS 2.3%

    Multiple SQL injection vulnerabilities exist in phpGACL 3.3.7. A specially crafted HTTP request can lead to a SQL injection. An attacker can send an HTTP request to trigger this vulnerability.

  22. 5.4CVE-2022-1181EPSS 51%

    Stored Cross Site Scripting in GitHub repository openemr/openemr prior to 6.0.0.2.

  23. 3.5CVE-2022-1180EPSS 0.6%

    Reflected Cross Site Scripting in GitHub repository openemr/openemr prior to 6.0.0.4.

  24. 5.4CVE-2022-1179EPSS 77%

    Non-Privilege User Can Created New Rule and Lead to Stored Cross Site Scripting in GitHub repository openemr/openemr prior to 6.0.0.4.

  25. 5.4CVE-2022-1178EPSS 52%

    Stored Cross Site Scripting in GitHub repository openemr/openemr prior to 6.0.0.4.

  26. 4.3CVE-2022-1177EPSS 0.9%

    Accounting User Can Download Patient Reports in openemr in GitHub repository openemr/openemr prior to 6.1.0.

  27. 5.4CVE-2022-24643EPSS 1.2%

    A stored cross-site scripting (XSS) issue was discovered in the OpenEMR Hospital Information Management System version 6.0.0.

  28. 4.3CVE-2022-25041EPSS 0.8%

    OpenEMR v6.0.0 was discovered to contain an incorrect access control issue.

  29. 8.1CVE-2022-25471EPSS 0.8%

    An Insecure Direct Object Reference (IDOR) vulnerability in OpenEMR 6.0.0 allows any authenticated attacker to access and modify unauthorized areas via a crafted POST request to /modules/zend_modules/public/Installer/register.