Filtered by vendor Open-emr
Subscriptions
Total
128 CVE
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2018-15154 | 1 Open-emr | 1 Openemr | 2024-08-05 | N/A |
| OS command injection occurring in versions of OpenEMR before 5.0.1.4 allows a remote authenticated attacker to execute arbitrary commands by making a crafted request to interface/billing/sl_eob_search.php after modifying the "print_command" global variable in interface/super/edit_globals.php. | ||||
| CVE-2018-10573 | 1 Open-emr | 1 Openemr | 2024-08-05 | N/A |
| interface/fax/fax_dispatch.php in OpenEMR before 5.0.1 allows remote authenticated users to bypass intended access restrictions via the scan parameter. | ||||
| CVE-2018-10571 | 1 Open-emr | 1 Openemr | 2024-08-05 | N/A |
| Multiple reflected cross-site scripting (XSS) vulnerabilities in OpenEMR before 5.0.1 allow remote attackers to inject arbitrary web script or HTML via the (1) patient parameter to interface/main/finder/finder_navigation.php; (2) key parameter to interface/billing/get_claim_file.php; (3) formid or (4) formseq parameter to interface/orders/types.php; (5) eraname, (6) paydate, (7) post_to_date, (8) deposit_date, (9) debug, or (10) InsId parameter to interface/billing/sl_eob_process.php; (11) form_source, (12) form_paydate, (13) form_deposit_date, (14) form_amount, (15) form_name, (16) form_pid, (17) form_encounter, (18) form_date, or (19) form_to_date parameter to interface/billing/sl_eob_search.php; (20) codetype or (21) search_term parameter to interface/de_identification_forms/find_code_popup.php; (22) search_term parameter to interface/de_identification_forms/find_drug_popup.php; (23) search_term parameter to interface/de_identification_forms/find_immunization_popup.php; (24) id parameter to interface/forms/CAMOS/view.php; (25) id parameter to interface/forms/reviewofs/view.php; or (26) list_id parameter to library/custom_template/personalize.php. | ||||
| CVE-2018-10572 | 1 Open-emr | 1 Openemr | 2024-08-05 | N/A |
| interface/patient_file/letter.php in OpenEMR before 5.0.1 allows remote authenticated users to bypass intended access restrictions via the newtemplatename and form_body parameters. | ||||
| CVE-2018-9250 | 1 Open-emr | 1 Openemr | 2024-08-05 | N/A |
| interface\super\edit_list.php in OpenEMR before v5_0_1_1 allows remote authenticated users to execute arbitrary SQL commands via the newlistname parameter. | ||||
| CVE-2019-17409 | 1 Open-emr | 1 Openemr | 2024-08-05 | 6.1 Medium |
| Reflected XSS exists in interface/forms/eye_mag/view.php in OpenEMR 5.x before 5.0.2.1 ia the id parameter. | ||||
| CVE-2019-17197 | 1 Open-emr | 1 Openemr | 2024-08-05 | 9.8 Critical |
| OpenEMR through 5.0.2 has SQL Injection in the Lifestyle demographic filter criteria in library/clinical_rules.php that affects library/patient.inc. | ||||
| CVE-2019-17179 | 1 Open-emr | 1 Openemr | 2024-08-05 | 6.1 Medium |
| 4.1.0, 4.1.1, 4.1.2, 4.1.2.3, 4.1.2.6, 4.1.2.7, 4.2.0, 4.2.1, 4.2.2, 5.0.0, 5.0.0.5, 5.0.0.6, 5.0.1, 5.0.1.1, 5.0.1.2, 5.0.1.3, 5.0.1.4, 5.0.1.5, 5.0.1.6, 5.0.1.7, 5.0.2, fixed in version 5.0.2.1 | ||||
| CVE-2019-16862 | 1 Open-emr | 1 Openemr | 2024-08-05 | 6.1 Medium |
| Reflected XSS in interface/forms/eye_mag/view.php in OpenEMR 5.x before 5.0.2.1 allows a remote attacker to execute arbitrary code in the context of a user's session via the pid parameter. | ||||
| CVE-2019-16404 | 1 Open-emr | 1 Openemr | 2024-08-05 | 8.8 High |
| Authenticated SQL Injection in interface/forms/eye_mag/js/eye_base.php in OpenEMR through 5.0.2 allows a user to extract arbitrary data from the openemr database via a non-parameterized INSERT INTO statement, as demonstrated by the providerID parameter. | ||||
| CVE-2019-14530 | 1 Open-emr | 1 Openemr | 2024-08-05 | 8.8 High |
| An issue was discovered in custom/ajax_download.php in OpenEMR before 5.0.2 via the fileName parameter. An attacker can download any file (that is readable by the user www-data) from server storage. If the requested file is writable for the www-data user and the directory /var/www/openemr/sites/default/documents/cqm_qrda/ exists, it will be deleted from server. | ||||
| CVE-2019-14529 | 1 Open-emr | 1 Openemr | 2024-08-05 | 9.8 Critical |
| OpenEMR before 5.0.2 allows SQL Injection in interface/forms/eye_mag/save.php. | ||||
| CVE-2019-8371 | 1 Open-emr | 1 Openemr | 2024-08-04 | 7.2 High |
| OpenEMR v5.0.1-6 allows code execution. | ||||
| CVE-2019-8368 | 1 Open-emr | 1 Openemr | 2024-08-04 | 6.1 Medium |
| OpenEMR v5.0.1-6 allows XSS. | ||||
| CVE-2019-3967 | 1 Open-emr | 1 Openemr | 2024-08-04 | N/A |
| In OpenEMR 5.0.1 and earlier, the patient file download interface contains a directory traversal flaw that allows authenticated attackers to download arbitrary files from the host system. | ||||
| CVE-2019-3965 | 1 Open-emr | 1 Openemr | 2024-08-04 | N/A |
| In OpenEMR 5.0.1 and earlier, controller.php contains a reflected XSS vulnerability in the document_id parameter. This could allow an attacker to execute arbitrary code in the context of a user's session. | ||||
| CVE-2019-3966 | 1 Open-emr | 1 Openemr | 2024-08-04 | N/A |
| In OpenEMR 5.0.1 and earlier, controller.php contains a reflected XSS vulnerability in the foreign_id parameter. This could allow an attacker to execute arbitrary code in the context of a user's session. | ||||
| CVE-2019-3968 | 1 Open-emr | 1 Openemr | 2024-08-04 | N/A |
| In OpenEMR 5.0.1 and earlier, an authenticated attacker can execute arbitrary commands on the host system via the Scanned Forms interface when creating a new form. | ||||
| CVE-2019-3964 | 1 Open-emr | 1 Openemr | 2024-08-04 | N/A |
| In OpenEMR 5.0.1 and earlier, controller.php contains a reflected XSS vulnerability in the doc_id parameter. This could allow an attacker to execute arbitrary code in the context of a user's session. | ||||
| CVE-2019-3963 | 1 Open-emr | 1 Openemr | 2024-08-04 | N/A |
| In OpenEMR 5.0.1 and earlier, controller.php contains a reflected XSS vulnerability in the patient_id parameter. This could allow an attacker to execute arbitrary code in the context of a user's session. | ||||