Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 10,361

CVE-2026-126469

OpenEMR before 8.5.0 Missing Authorization in custom/ Export and Chart-Tracker Scripts

OpenEMR before 8.5.0 contains a missing authorization vulnerability in several custom/ scripts that rely only on session authentication and never call AclMain::aclCheckCore(). Any authenticated low-privilege user can request export_labworks.php, chart_tracker.php, or export_registry_xml.php to disclose patient SSN, DOB, and insurance data or provider NPI/tax IDs, and forge chart-tracker records.

CVSS 4.0 · 8.7 High EPSS n/a KEV · Not listed
Vendors
Open-emr
Products
Openemr
CVE-2026-126470

OpenEMR before 8.5.0 IDOR in Carecoordination CCDA/CCR/QRDA Document Actions

OpenEMR before 8.5.0 contains an insecure direct object reference vulnerability in the Carecoordination module that allows authenticated users with send_to_hie permission to access any patient's CCDA/CCR/QRDA documents. Attackers can supply arbitrary document or patient IDs to download, transmit, or export patient health records, inject falsified clinical data, and delete audit records.

CVSS 4.0 · 8.7 High EPSS n/a KEV · Not listed
Vendors
Open-emr
Products
Openemr
CVE-2026-126471

OpenEMR before 8.5.0 Missing Authorization via print_referral.php and trend_form.php

OpenEMR before 8.5.0 contains a missing authorization vulnerability in print_referral.php and trend_form.php that allows low-privileged Front Office users to access patient PHI without patients:med permission. Attackers can directly request these endpoints with arbitrary patient_id values to retrieve patient demographics, insurance data, and vitals history, enumerating IDs to expand disclosure.

CVSS 4.0 · 7.1 High EPSS n/a KEV · Not listed
Vendors
Open-emr
Products
Openemr
CVE-2026-126472

OpenEMR before 8.5.0 Missing Authorization in ccdaservice/ccda_gateway.php C-CDA Disclosure

OpenEMR before 8.5.0 contains a missing authorization vulnerability in ccdaservice/ccda_gateway.php that allows any authenticated low-privilege staff user to retrieve other patients' C-CDA documents. Attackers can request the view or dl action with sequential pid values and their own CSRF token to enumerate and exfiltrate medications, problems, allergies, and immunizations.

CVSS 4.0 · 8.7 High EPSS n/a KEV · Not listed
Vendors
Open-emr
Products
Openemr
CVE-2026-126473

OpenEMR before 8.4.0 OAuth Authorization Bypass via Scope Canonicalization

OpenEMR before 8.4.0 contains OAuth scope canonicalization and containment flaws that allow unauthenticated attackers to obtain unapproved system-level FHIR access. Attackers can register a colon-form system:Patient.read client that bypasses approval, then request unregistered system/Patient.write scope to read, modify, and create Patient records.

CVSS 4.0 · 9.3 Critical EPSS n/a KEV · Not listed
Vendors
Open-emr
Products
Openemr
CVE-2026-126474

OpenEMR before 8.5.0 Reflected XSS via ACL Module module_id Parameter

OpenEMR before 8.5.0 contains a reflected cross-site scripting vulnerability in the ACL module that allows attackers to execute JavaScript in authenticated sessions via the module_id parameter. Attackers can deliver crafted acl/index or acl/acl links that inject unencoded input into inline script blocks, stealing non-HttpOnly session cookies and modifying ACL configuration.

CVSS 4.0 · 5.1 Medium EPSS n/a KEV · Not listed
Vendors
Open-emr
Products
Openemr
CVE-2026-126475

OpenEMR before 8.5.0 Reflected XSS via searchEleNo in Auto-Suggest Endpoint

OpenEMR before 8.5.0 contains a reflected cross-site scripting vulnerability that allows authenticated attackers to execute JavaScript by injecting payloads into the searchEleNo POST parameter of the application/index/search endpoint. Attackers can break out of unencoded HTML attributes in auto-suggest.phtml to inject event handlers that fire on DOM insertion, stealing non-HttpOnly session cookies and patient data.

CVSS 4.0 · 5.1 Medium EPSS n/a KEV · Not listed
Vendors
Open-emr
Products
Openemr
CVE-2026-126476

OpenEMR before 8.5.0 Reflected XSS via auto-suggest searchMode parameter

OpenEMR before 8.5.0 contains a reflected cross-site scripting vulnerability in the Application module's auto-suggest endpoint, which echoes the searchMode POST parameter unencoded into a single-quoted onClick attribute. Attackers can induce an authenticated user to submit a single-quote payload to application/index/search, executing arbitrary JavaScript in that user's session to steal session cookies or disclose patient data.

CVSS 4.0 · 5.1 Medium EPSS n/a KEV · Not listed
Vendors
Open-emr
Products
Openemr
CVE-2026-126477

OpenEMR before 8.5.0 Stored XSS via Eye Exam Defaults in eye_base.php

OpenEMR before 8.5.0 contains a stored cross-site scripting vulnerability in the Eye Exam (eye_mag) module that allows administrators to inject JavaScript through unencoded Eye_defaults list option titles. Attackers can store a crafted title via edit_list.php that breaks out of a jQuery string in eye_base.php, executing script in any authenticated user's session when they click Defaults.

CVSS 4.0 · 4.6 Medium EPSS n/a KEV · Not listed
Vendors
Open-emr
Products
Openemr
CVE-2026-126478

OpenEMR before 8.5.0 SQL Injection via form_icd_codes in Syndromic Surveillance

OpenEMR before 8.5.0 contains an SQL injection vulnerability in the Syndromic Surveillance report because the form_icd_codes[] POST array is concatenated into an unquoted numeric IN() clause without integer validation. Authenticated users can submit quote-free payloads that bypass add_escape_custom to perform blind or UNION-based injection and exfiltrate patient health information.

CVSS 4.0 · 7.2 High EPSS n/a KEV · Not listed
Vendors
Open-emr
Products
Openemr
CVE-2026-126479

OpenEMR before 8.5.0 Missing Authorization in Module Manager Installer Actions

OpenEMR before 8.5.0 contains a missing authorization vulnerability in five Module Manager InstallerController actions that lack the admin/manage_modules ACL check and CSRF validation. Low-privilege users such as Front Office accounts can POST to saveConfig or SaveHooks to overwrite any module's configuration, retarget CCDA and HIE settings, and delete module hooks.

CVSS 4.0 · 7.2 High EPSS n/a KEV · Not listed
Vendors
Open-emr
Products
Openemr
CVE-2026-126480

OpenEMR before 8.5.0 SQL Injection via CCR revandapprove Parameter Names

OpenEMR before 8.5.0 contains an sql injection vulnerability in CcrTable::insertApprovedData() that allows authenticated users to inject SQL through request parameter names used as column names. Attackers can send crafted patient_data-*-sel parameters to the revandapprove route, lacking ACL and CSRF checks, to copy password hashes into patient fields or corrupt records.

CVSS 4.0 · 8.6 High EPSS n/a KEV · Not listed
Vendors
Open-emr
Products
Openemr
CVE-2026-126481

OpenEMR before 8.5.0 Path Traversal via ERA 835 File Upload

OpenEMR before 8.5.0 contains a path traversal vulnerability in era_payments.php and sl_eob_search.php that allows authenticated billing users to write files outside the ERA directory. Attackers can embed traversal sequences in the GS04 element of an uploaded X12 835 file to overwrite .edi or .835 files with attacker-controlled content anywhere writable by the web server.

CVSS 4.0 · 7.2 High EPSS n/a KEV · Not listed
Vendors
Open-emr
Products
Openemr
CVE-2026-126482

OpenEMR before 8.5.0 SQL Injection via CLP01 element of X12 835 ERA upload

OpenEMR before 8.5.0 contains an SQL injection vulnerability in SLEOB::slInvoiceNumber() in src/Billing/SLEOB.php, which concatenates the CLP01 claim identifier from uploaded X12 835 ERA files into a query without escaping or parameter binding. Authenticated users with billing permissions, or a malicious payer whose ERA file a clerk uploads, can execute arbitrary SQL to read any table, including users_secure password hashes, and modify data.

CVSS 4.0 · 8.7 High EPSS n/a KEV · Not listed
Vendors
Open-emr
Products
Openemr
CVE-2026-126483

OpenEMR before 8.5.0 SQL Injection via form_facility in ippf_statistics.php

OpenEMR before 8.5.0 contains an SQL injection vulnerability that allows authenticated report users to manipulate queries by supplying a crafted form_facility value to interface/reports/ippf_statistics.php. Attackers can close the string literal in the facility_id WHERE clause and use boolean or time-based payloads to read sensitive database contents.

CVSS 4.0 · 7.1 High EPSS n/a KEV · Not listed
Vendors
Open-emr
Products
Openemr
CVE-2026-126484

OpenEMR before 8.5.0 Stored XSS via Printed Fee Sheet Appointment Comments

OpenEMR before 8.5.0 contains a stored cross-site scripting vulnerability in printed_fee_sheet.php that allows authenticated portal patients to inject script by setting unescaped appointment comments (pc_hometext). Attackers can submit HTML payloads via the form_comments field in add_edit_event_user.php that execute when staff open the patient's fee sheet, acting within the staff session.

CVSS 4.0 · 5.1 Medium EPSS n/a KEV · Not listed
Vendors
Open-emr
Products
Openemr
CVE-2026-126485

OpenEMR before 8.5.0 CSRF via Observation Form delete.php

OpenEMR before 8.5.0 contains a cross-site request forgery vulnerability in ObservationController::deleteAction that allows attackers to delete observation form records without a CSRF token. Attackers can lure a logged-in clinician to a page issuing a GET to delete.php with guessed id values, soft-deleting observations in the victim's open encounter.

CVSS 4.0 · 5.3 Medium EPSS n/a KEV · Not listed
Vendors
Open-emr
Products
Openemr
CVE-2026-126486

OpenEMR before 8.5.0 Missing Authorization via portal/import_template.php

OpenEMR before 8.5.0 contains a missing authorization vulnerability in portal/import_template.php, where several portal document template modes lack admin/forms ACL and CSRF checks. Any authenticated staff user can send mode=save_profiles to delete all template profile assignments, use other unguarded modes to push templates to patients or change categories, and read template bodies via mode=get or getPdf.

CVSS 4.0 · 7.2 High EPSS n/a KEV · Not listed
Vendors
Open-emr
Products
Openemr
CVE-2026-126487

OpenEMR before 8.5.0 Global Configuration Override via user_settings.php

OpenEMR before 8.5.0 contains an authorization bypass vulnerability that allows authenticated users to override system-wide global configuration values by storing global-prefixed keys through library/ajax/user_settings.php. Attackers can submit lab or target parameters with global: prefixed setting names to disable audit logging, weaken password policies, or alter security-sensitive settings persistently for their sessions.

CVSS 4.0 · 8.7 High EPSS n/a KEV · Not listed
Vendors
Open-emr
Products
Openemr
CVE-2026-126488

OpenEMR before 8.5.0 SQL Injection via OnsiteDocument.Query _BitwiseAnd

OpenEMR before 8.5.0 contains an SQL injection vulnerability in the patient portal OnsiteDocument.Query endpoint, where mass-assigned _BitwiseAnd criteria parameters are placed unquoted into SQL with only quote-character escaping. Authenticated portal patients can inject SQL outside their per-patient scope to read the entire database, including other patients' demographics and users_secure password hashes.

CVSS 4.0 · 8.3 High EPSS n/a KEV · Not listed
Vendors
Open-emr
Products
Openemr