Open-emr

Openemr

221 Schwachstellen gefunden.

Hinweis: Diese Liste kann unvollständig sein. Daten werden ohne Gewähr im Ursprungsformat bereitgestellt.
7.5

CVE-2017-16540

Exploit
  • EPSS 1.25%
  • Veröffentlicht 04.11.2017 19:29:00
  • Zuletzt bearbeitet 13.05.2026 00:24:29

OpenEMR before 5.0.0 Patch 5 allows unauthenticated remote database copying because setup.php exposes functionality for cloning an existing OpenEMR site to an arbitrary attacker-controlled MySQL server via vectors involving a crafted state parameter.

7.5

CVE-2017-12064

  • EPSS 1.2%
  • Veröffentlicht 01.08.2017 05:29:00
  • Zuletzt bearbeitet 13.05.2026 00:24:29

The csv_log_html function in library/edihistory/edih_csv_inc.php in OpenEMR 5.0.0 and prior allows attackers to bypass intended access restrictions via a crafted name.

8.8

CVE-2017-9380

Exploit
  • EPSS 15.19%
  • Veröffentlicht 02.06.2017 15:29:00
  • Zuletzt bearbeitet 13.05.2026 00:24:29

OpenEMR 5.0.0 and prior allows low-privilege users to upload files of dangerous types which can result in arbitrary code execution within the context of the vulnerable application.

6.1

CVE-2017-6394

Exploit
  • EPSS 1.21%
  • Veröffentlicht 02.03.2017 06:59:00
  • Zuletzt bearbeitet 13.05.2026 00:24:29

Multiple Cross-Site Scripting (XSS) issues were discovered in OpenEMR 5.0.0 and 5.0.1-dev. The vulnerabilities exist due to insufficient filtration of user-supplied data passed to the "openemr-master/gacl/admin/object_search.php" URL (section_value; ...

5

CVE-2015-4453

  • EPSS 2.87%
  • Veröffentlicht 05.07.2015 01:59:00
  • Zuletzt bearbeitet 06.05.2026 22:30:45

interface/globals.php in OpenEMR 2.x, 3.x, and 4.x before 4.2.0 patch 2 allows remote attackers to bypass authentication and obtain sensitive information via an ignoreAuth=1 value to certain scripts, as demonstrated by (1) interface/fax/fax_dispatch_...

6.5

CVE-2014-5462

Exploit
  • EPSS 1.99%
  • Veröffentlicht 08.12.2014 16:59:00
  • Zuletzt bearbeitet 06.05.2026 22:30:45

Multiple SQL injection vulnerabilities in OpenEMR 4.1.2 (Patch 7) and earlier allow remote authenticated users to execute arbitrary SQL commands via the (1) layout_id parameter to interface/super/edit_layout.php; (2) form_patient_id, (3) form_drug_na...

6.5

CVE-2013-4619

  • EPSS 1.05%
  • Veröffentlicht 09.08.2013 21:55:07
  • Zuletzt bearbeitet 29.04.2026 01:13:23

Multiple SQL injection vulnerabilities in OpenEMR 4.1.1 allow remote authenticated users to execute arbitrary SQL commands via the (1) start or (2) end parameter to interface/reports/custom_report_range.php, or the (3) form_newid parameter to custom/...

4.3

CVE-2013-4620

  • EPSS 3.28%
  • Veröffentlicht 09.08.2013 21:55:07
  • Zuletzt bearbeitet 29.04.2026 01:13:23

Cross-site scripting (XSS) vulnerability in interface/main/onotes/office_comments_full.php in OpenEMR 4.1.1 allows remote attackers to inject arbitrary web script or HTML via the note parameter.

7.5

CVE-2012-2115

Exploit
  • EPSS 2.15%
  • Veröffentlicht 09.09.2012 21:55:07
  • Zuletzt bearbeitet 16.06.2026 23:41:01

SQL injection vulnerability in interface/login/validateUser.php in OpenEMR 4.1.0 and possibly earlier allows remote attackers to execute arbitrary SQL commands via the u parameter.

6.8

CVE-2011-5161

Exploit
  • EPSS 1.97%
  • Veröffentlicht 09.09.2012 21:55:04
  • Zuletzt bearbeitet 16.06.2026 23:36:03

Unrestricted file upload vulnerability in the patient photograph functionality in OpenEMR 4 allows remote attackers to execute arbitrary PHP code by uploading a file with an executable extension followed by a safe extension, then accessing it via a d...