cve.bz

open-emr openemr vulnerabilities in 2023, newest first

Filter

By year: all 2026 2025 2024 2023 2022 2021

  1. 8.1CVE-2023-2950EPSS 0.6%

    Improper Authorization in GitHub repository openemr/openemr prior to 7.0.1.

  2. 6.1CVE-2023-2949ExploitEPSS 1.5%

    Cross-site Scripting (XSS) - Reflected in GitHub repository openemr/openemr prior to 7.0.1.

  3. 6.1CVE-2023-2948ExploitEPSS 97%

    Cross-site Scripting (XSS) - Generic in GitHub repository openemr/openemr prior to 7.0.1.

  4. 4.8CVE-2023-2947EPSS 90%

    Cross-site Scripting (XSS) - Stored in GitHub repository openemr/openemr prior to 7.0.1.

  5. 8.1CVE-2023-2946EPSS 0.5%

    Improper Access Control in GitHub repository openemr/openemr prior to 7.0.1.

  6. 5.4CVE-2023-2945EPSS 0.4%

    Missing Authorization in GitHub repository openemr/openemr prior to 7.0.1.

  7. 5.4CVE-2023-2944EPSS 0.4%

    Improper Access Control in GitHub repository openemr/openemr prior to 7.0.1.

  8. 8.8CVE-2023-2943EPSS 0.6%

    Code Injection in GitHub repository openemr/openemr prior to 7.0.1.

  9. 8.1CVE-2023-2942EPSS 0.8%

    Improper Input Validation in GitHub repository openemr/openemr prior to 7.0.1.

  10. 4.3CVE-2023-2674EPSS 0.6%

    Improper Access Control in GitHub repository openemr/openemr prior to 7.0.1.

  11. 4.8CVE-2023-2566EPSS 0.5%

    Cross-site Scripting (XSS) - Stored in GitHub repository openemr/openemr prior to 7.0.1.

  12. 7.5CVE-2023-22974EPSS 1.9%

    A Path Traversal in setup.php in OpenEMR < 7.0.0 allows remote unauthenticated users to read arbitrary files by controlling a connection to an attacker-controlled MySQL server.

  13. 8.8CVE-2023-22973EPSS 1.8%

    A Local File Inclusion (LFI) vulnerability in interface/forms/LBF/new.php in OpenEMR < 7.0.0 allows remote authenticated users to execute code via the formname parameter.

  14. 5.4CVE-2023-22972EPSS 0.4%

    A Reflected Cross-site scripting (XSS) vulnerability in interface/forms/eye_mag/php/eye_mag_functions.php in OpenEMR < 7.0.0 allows remote authenticated users to inject arbitrary web script or HTML via the REQUEST_URI.