Open-emr

Openemr

221 Schwachstellen gefunden.

Hinweis: Diese Liste kann unvollständig sein. Daten werden ohne Gewähr im Ursprungsformat bereitgestellt.
9.8

CVE-2018-15143

  • EPSS 2.2%
  • Veröffentlicht 13.08.2018 18:29:00
  • Zuletzt bearbeitet 21.11.2024 03:50:23

Multiple SQL injection vulnerabilities in portal/find_appt_popup_user.php in versions of OpenEMR before 5.0.1.4 allow a remote attacker to execute arbitrary SQL commands via the (1) catid or (2) providerid parameter.

8.8

CVE-2018-15144

  • EPSS 1.85%
  • Veröffentlicht 13.08.2018 18:29:00
  • Zuletzt bearbeitet 21.11.2024 03:50:24

SQL injection vulnerability in interface/de_identification_forms/find_drug_popup.php in versions of OpenEMR before 5.0.1.4 allows a remote authenticated attacker to execute arbitrary SQL commands via the search_term parameter.

8.8

CVE-2018-9250

  • EPSS 31.55%
  • Veröffentlicht 18.05.2018 14:29:00
  • Zuletzt bearbeitet 21.11.2024 04:15:13

interface\super\edit_list.php in OpenEMR before v5_0_1_1 allows remote authenticated users to execute arbitrary SQL commands via the newlistname parameter.

6.1

CVE-2018-10571

  • EPSS 1.53%
  • Veröffentlicht 30.04.2018 17:29:00
  • Zuletzt bearbeitet 21.11.2024 03:41:34

Multiple reflected cross-site scripting (XSS) vulnerabilities in OpenEMR before 5.0.1 allow remote attackers to inject arbitrary web script or HTML via the (1) patient parameter to interface/main/finder/finder_navigation.php; (2) key parameter to int...

6.5

CVE-2018-10572

Exploit
  • EPSS 1.91%
  • Veröffentlicht 30.04.2018 17:29:00
  • Zuletzt bearbeitet 21.11.2024 03:41:35

interface/patient_file/letter.php in OpenEMR before 5.0.1 allows remote authenticated users to bypass intended access restrictions via the newtemplatename and form_body parameters.

8.8

CVE-2018-10573

Exploit
  • EPSS 2.66%
  • Veröffentlicht 30.04.2018 17:29:00
  • Zuletzt bearbeitet 21.11.2024 03:41:35

interface/fax/fax_dispatch.php in OpenEMR before 5.0.1 allows remote authenticated users to bypass intended access restrictions via the scan parameter.

9

CVE-2018-1000019

Exploit
  • EPSS 3.83%
  • Veröffentlicht 09.02.2018 23:29:00
  • Zuletzt bearbeitet 21.11.2024 03:39:26

OpenEMR version 5.0.0 contains a OS Command Injection vulnerability in fax_dispatch.php that can result in OS command injection by an authenticated attacker with any role. This vulnerability appears to have been fixed in 5.0.0 Patch 2 or higher.

6.1

CVE-2018-1000020

Exploit
  • EPSS 0.67%
  • Veröffentlicht 09.02.2018 23:29:00
  • Zuletzt bearbeitet 21.11.2024 03:39:26

OpenEMR version 5.0.0 contains a Cross Site Scripting (XSS) vulnerability in open-flash-chart.swf and _posteddata.php that can result in . This vulnerability appears to have been fixed in 5.0.0 Patch 2 or higher.

5.4

CVE-2017-1000240

  • EPSS 0.74%
  • Veröffentlicht 17.11.2017 03:29:00
  • Zuletzt bearbeitet 13.05.2026 00:24:29

The application OpenEMR is affected by multiple reflected & stored Cross-Site Scripting (XSS) vulnerabilities affecting version 5.0.0 and prior versions. These vulnerabilities could allow remote authenticated attackers to inject arbitrary web script ...

8.1

CVE-2017-1000241

  • EPSS 0.7%
  • Veröffentlicht 17.11.2017 03:29:00
  • Zuletzt bearbeitet 13.05.2026 00:24:29

The application OpenEMR version 5.0.0, 5.0.1-dev and prior is affected by vertical privilege escalation vulnerability. This vulnerability can allow an authenticated non-administrator users to view and modify information only accessible to administrat...