repository icon
openemr / openemr Project repository

The most popular open source electronic health records and medical practice management solution.

Submit a report

FIRST INTERACTION

WITHIN2 DAYS

REVIEW

WITHIN18 DAYS

FIX

WITHIN71 DAYS

Stored XSS in Secure Messaging
tuannq2299
High
•CVE-2024-0875
Receptionist view information of Patients
anh91
pending
Unauthenticated Path Traversal
baobaovt
not applicable
XML Entity Expansion in import_xml.php can lead to Denial-of-Service
nalysius
not applicable
SQL injection in the delete action of the file add_edit_event.php
nhienit2010
High
Reflected XSS in /library/custom_template/share_template.php
tsarsecurity
High
•CVE-2023-2948
Reflected XSS in interface/forms/eye_mag/js/eye_base.php
tsarsecurity
High
•CVE-2023-2949
Failed Password Change is Not Logged
henrycrain
informative
Medium
Patient Social Security Numbers Disclosed in Log
henrycrain
informative
Medium
CSRF through unchecked token in Patient Finder
hainluud
informative
Medium
Stored XSS in Admin Panel
henrycrain
Medium
•CVE-2023-2947
Access Control Vulnerability in Prescription Controller
drew-sec
Medium
•CVE-2023-2946
Access Control Vulnerability in Admin Address Book
drew-sec
Medium
•CVE-2023-2944
Missing Authorization Check Allows Impersonated Secure Messages
drew-sec
Medium
•CVE-2023-2945
XSS via upload pdf file
christynorl
self closed
Broken Access Controls in Pratice settings
nhienit2010
High
•CVE-2023-2674
Bypass client side restrictions leads to IDOR on creating appointment.
leorac
High
•CVE-2023-2942
Patient ability to rewrite it's own documents leads to HTML injection
leorac
Medium
•CVE-2023-2950
Stored HTML injection in Patient chat functionality
leorac
Medium
•CVE-2023-2943
Stored XSS bypass the protection rules
christynorl
High
•CVE-2023-2566
Broken Access Controls in Patient Files
xkulio
High
•CVE-2022-4567
File Upload Type Validation Error
xkulio
High
•CVE-2022-4506
Improper Name Validation in Upload Document Form
xkulio
High
•CVE-2022-4504
Reflected Cross-Site Scripting in Front Payment CC
xkulio
Medium
•CVE-2022-4503
Multiple Reflected Cross-Site Scripting in Messages Module
xkulio
High
•CVE-2022-4502
Multiple Authenticated Remote Code Execution Vulnerabilities in Admin Panel
the-login
High
Stored XSS
mike993
Medium
•CVE-2022-4733
Cookie with Secure attribute is false
uonghoangminhchau
informative
High
Cookie with HTTPOnly is false
uonghoangminhchau
informative
High
Cross Site Scripting (reflected) on fee_sheet_ajax.php
0xd114
High
•CVE-2022-4615
No Protection against Bruteforce attacks on Loing page
y-seung
informative
Medium
Tabnabbing via window.opener [www.open-emr.org]
agnihackers
informative
High
User can do all actives with other's signature (view, get, create, update, dele...
dyn20
High
•CVE-2022-2824
IDOR leads to delete messages in Message Center of others.
dyn20
High
Cross-site Scripting - Reflected
ch1nhpd
Critical
•CVE-2022-2733
Idor disclose other user's appointment
gaurav-g2
High
•$10•CVE-2022-4505
Cross site script
gaurav-g2
High
•$15
DOM-based Cross-Site Scripting (XSS) in OpenEMR 7.0.0 and below at White list fi...
johnnattakit
Medium
•CVE-2022-2729
Non-Privilege user can view Patient's Amendments
rata99
Medium
•CVE-2022-2730
Unauthorized to create and edit Amendments function
rata99
High
•CVE-2022-2732
Send message in chat function with any username
dyn20
High
•$9
Account Takeover
akshayravic09yc47
informative
Critical
Reflected Cross Site Scripting in OpenEMR 7.0.0 and below at backup
johnnattakit
Medium
•CVE-2022-2731
UI REDRESSING
tharunavula
Critical
•$25•CVE-2022-2734
Improper authorization - clinician can view and change practice settings.
justinp09010
duplicate
Critical
Improper privilege management - clinician can configure order and results
justinp09010
duplicate
Critical
Improper authorization - clinician can create and view payments
justinp09010
duplicate
Critical
Cross-site Scripting (XSS) - Stored
bugruto
Medium
•CVE-2022-2494
Improper authorization - receptionist can read all Clinic reports
justinp09010
High
•$15
Improper Privilege Management - receptionist can view background services and lo...
justinp09010
High
•$15
Improper authorization - receptionist can read all secure messaging
justinp09010
High
•$15
Non-Privilege User Can View Patient’s Disclosures
r00tpgp
High
•$15•CVE-2022-1459
Missing Function Level Access Control
r00tpgp
High
•$15•CVE-2022-2493
Non Privilege User can Enable or Disable Registered
r00tpgp
High
•$15•CVE-2022-1461
Stored XSS Leads To Session Hijacking
mdakh404
High
•$15•CVE-2022-1458
Stored Cross Site Scripting
r00tpgp
High
•$15•CVE-2022-1181
Reflected Cross Site Scripting
r00tpgp
Medium
•CVE-2022-1180
Non-Privilege User Can Created New Rule and Lead to Stored Cross Site Scripting
r00tpgp
Medium
•CVE-2022-1179
Stored Cross Site Scripting
r00tpgp
High
•$15•CVE-2022-1178
Accounting User Can Download Patient Reports in openemr
r00tpgp
Medium
•CVE-2022-1177
Improper Privilege Management
thelabda
Medium
•$40