Open-emr

Openemr

218 Schwachstellen gefunden.

Hinweis: Diese Liste kann unvollständig sein. Daten werden ohne Gewähr im Ursprungsformat bereitgestellt.
6.1

CVE-2017-6394

Exploit
  • EPSS 1.21%
  • Veröffentlicht 02.03.2017 06:59:00
  • Zuletzt bearbeitet 13.05.2026 00:24:29

Multiple Cross-Site Scripting (XSS) issues were discovered in OpenEMR 5.0.0 and 5.0.1-dev. The vulnerabilities exist due to insufficient filtration of user-supplied data passed to the "openemr-master/gacl/admin/object_search.php" URL (section_value; ...

5

CVE-2015-4453

  • EPSS 2.87%
  • Veröffentlicht 05.07.2015 01:59:00
  • Zuletzt bearbeitet 06.05.2026 22:30:45

interface/globals.php in OpenEMR 2.x, 3.x, and 4.x before 4.2.0 patch 2 allows remote attackers to bypass authentication and obtain sensitive information via an ignoreAuth=1 value to certain scripts, as demonstrated by (1) interface/fax/fax_dispatch_...

6.5

CVE-2014-5462

Exploit
  • EPSS 1.99%
  • Veröffentlicht 08.12.2014 16:59:00
  • Zuletzt bearbeitet 06.05.2026 22:30:45

Multiple SQL injection vulnerabilities in OpenEMR 4.1.2 (Patch 7) and earlier allow remote authenticated users to execute arbitrary SQL commands via the (1) layout_id parameter to interface/super/edit_layout.php; (2) form_patient_id, (3) form_drug_na...

6.5

CVE-2013-4619

  • EPSS 1.05%
  • Veröffentlicht 09.08.2013 21:55:07
  • Zuletzt bearbeitet 29.04.2026 01:13:23

Multiple SQL injection vulnerabilities in OpenEMR 4.1.1 allow remote authenticated users to execute arbitrary SQL commands via the (1) start or (2) end parameter to interface/reports/custom_report_range.php, or the (3) form_newid parameter to custom/...

4.3

CVE-2013-4620

  • EPSS 3.28%
  • Veröffentlicht 09.08.2013 21:55:07
  • Zuletzt bearbeitet 29.04.2026 01:13:23

Cross-site scripting (XSS) vulnerability in interface/main/onotes/office_comments_full.php in OpenEMR 4.1.1 allows remote attackers to inject arbitrary web script or HTML via the note parameter.

7.5

CVE-2012-2115

Exploit
  • EPSS 2.15%
  • Veröffentlicht 09.09.2012 21:55:07
  • Zuletzt bearbeitet 16.06.2026 23:41:01

SQL injection vulnerability in interface/login/validateUser.php in OpenEMR 4.1.0 and possibly earlier allows remote attackers to execute arbitrary SQL commands via the u parameter.

6.8

CVE-2011-5161

Exploit
  • EPSS 1.97%
  • Veröffentlicht 09.09.2012 21:55:04
  • Zuletzt bearbeitet 16.06.2026 23:36:03

Unrestricted file upload vulnerability in the patient photograph functionality in OpenEMR 4 allows remote attackers to execute arbitrary PHP code by uploading a file with an executable extension followed by a safe extension, then accessing it via a d...

4.3

CVE-2011-5160

Exploit
  • EPSS 1.33%
  • Veröffentlicht 09.09.2012 21:55:03
  • Zuletzt bearbeitet 16.06.2026 23:36:03

Cross-site scripting (XSS) vulnerability in setup.php in OpenEMR 4 allows remote attackers to inject arbitrary web script or HTML via the site parameter.