Open-Emr Openemr vulnerabilities

CVE-2021-25921 [MEDIUM] CWE-79 CVE-2021-25921: In OpenEMR, versions 2.7.3-rc1 to 6.0.0 are vulnerable to Stored Cross-Site-Scripting (XSS) due to u In OpenEMR, versions 2.7.3-rc1 to 6.0.0 are vulnerable to Stored Cross-Site-Scripting (XSS) due to user input not being validated properly in the `Allergies` section. An attacker could lure an admin to enter a malicious payload and by that initiate the exploit.

CVE-2025-67645 [HIGH] CWE-284 CVE-2025-67645: OpenEMR is a free and open source electronic health records and medical practice management applicat OpenEMR is a free and open source electronic health records and medical practice management application. Versions prior to 7.0.4 have a broken access control in the Profile Edit endpoint. An authenticated normal user can modify the request parameters (pubpid / pid) to reference another user’s record; the server accepts the modified IDs and applies the

CVE-2026-25131 [HIGH] CWE-862 CVE-2026-25131: OpenEMR is a free and open source electronic health records and medical practice management applicat OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 8.0.0, a Broken Access Control vulnerability exists in the OpenEMR order types management system, allowing low-privilege users (such as Receptionist) to add and modify procedure types without proper authorization. This vulnerabilit

CVE-2023-2949 [MEDIUM] CWE-79 CVE-2023-2949: Cross-site Scripting (XSS) - Reflected in GitHub repository openemr/openemr prior to 7.0.1. Cross-site Scripting (XSS) - Reflected in GitHub repository openemr/openemr prior to 7.0.1.

CVE-2020-13562 [MEDIUM] CWE-80 CVE-2020-13562: A cross-site scripting vulnerability exists in the template functionality of phpGACL 3.3.7. A specia A cross-site scripting vulnerability exists in the template functionality of phpGACL 3.3.7. A specially crafted HTTP request can lead to arbitrary JavaScript execution. An attacker can provide a crafted URL to trigger this vulnaerability in the phpGACL template action parameter.

CVE-2022-1179 [MEDIUM] CWE-79 CVE-2022-1179: Non-Privilege User Can Created New Rule and Lead to Stored Cross Site Scripting in GitHub repository Non-Privilege User Can Created New Rule and Lead to Stored Cross Site Scripting in GitHub repository openemr/openemr prior to 6.0.0.4.

CVE-2018-15146 [HIGH] CWE-89 CVE-2018-15146: SQL injection vulnerability in interface/de_identification_forms/find_immunization_popup.php in vers SQL injection vulnerability in interface/de_identification_forms/find_immunization_popup.php in versions of OpenEMR before 5.0.1.4 allows a remote authenticated attacker to execute arbitrary SQL commands via the 'search_term' parameter.

CVE-2018-15148 [HIGH] CWE-89 CVE-2018-15148: SQL injection vulnerability in interface/patient_file/encounter/search_code.php in versions of OpenE SQL injection vulnerability in interface/patient_file/encounter/search_code.php in versions of OpenEMR before 5.0.1.4 allows a remote authenticated attacker to execute arbitrary SQL commands via the 'text' parameter.

CVE-2018-15151 [HIGH] CWE-89 CVE-2018-15151: SQL injection vulnerability in interface/de_identification_forms/find_code_popup.php in versions of SQL injection vulnerability in interface/de_identification_forms/find_code_popup.php in versions of OpenEMR before 5.0.1.4 allows a remote authenticated attacker to execute arbitrary SQL commands via the 'search_term' parameter.

CVE-2018-15144 [HIGH] CWE-89 CVE-2018-15144: SQL injection vulnerability in interface/de_identification_forms/find_drug_popup.php in versions of SQL injection vulnerability in interface/de_identification_forms/find_drug_popup.php in versions of OpenEMR before 5.0.1.4 allows a remote authenticated attacker to execute arbitrary SQL commands via the search_term parameter.

CVE-2026-25746 [HIGH] CWE-89 CVE-2026-25746: OpenEMR is a free and open source electronic health records and medical practice management applicat OpenEMR is a free and open source electronic health records and medical practice management application. Versions prior to 8.0.0 contain a SQL injection vulnerability in prescription that can be exploited by authenticated attackers. The vulnerability exists due to insufficient input validation in the prescription listing functionality. Version 8.0.0 fi

CVE-2026-33917 [HIGH] CWE-89 CVE-2026-33917: OpenEMR is a free and open source electronic health records and medical practice management applicat OpenEMR is a free and open source electronic health records and medical practice management application. Versions prior to 8.0.0.3 contais a SQL injection vulnerability in the ajax_save CAMOS form that can be exploited by authenticated attackers. The vulnerability exists due to insufficient input validation in the ajax_save page in the CAMOS form. Vers

CVE-2020-13564 [MEDIUM] CWE-80 CVE-2020-13564: A cross-site scripting vulnerability exists in the template functionality of phpGACL 3.3.7. A specia A cross-site scripting vulnerability exists in the template functionality of phpGACL 3.3.7. A specially crafted HTTP request can lead to arbitrary JavaScript execution. An attacker can provide a crafted URL to trigger this vulnerability in the phpGACL template acl_id parameter.

CVE-2020-13563 [MEDIUM] CWE-80 CVE-2020-13563: A cross-site scripting vulnerability exists in the template functionality of phpGACL 3.3.7. A specia A cross-site scripting vulnerability exists in the template functionality of phpGACL 3.3.7. A specially crafted HTTP request can lead to arbitrary JavaScript execution. An attacker can provide a crafted URL to trigger this vulnerability in the phpGACL template group_id parameter.

CVE-2018-15149 [HIGH] CWE-89 CVE-2018-15149: SQL injection vulnerability in interface/forms/eye_mag/php/Anything_simple.php from library/forms.in SQL injection vulnerability in interface/forms/eye_mag/php/Anything_simple.php from library/forms.inc in versions of OpenEMR before 5.0.1.4 allows a remote authenticated attacker to execute arbitrary SQL commands via the 'encounter' parameter.

CVE-2018-15150 [HIGH] CWE-89 CVE-2018-15150: SQL injection vulnerability in interface/de_identification_forms/de_identification_screen2.php in ve SQL injection vulnerability in interface/de_identification_forms/de_identification_screen2.php in versions of OpenEMR before 5.0.1.4 allows a remote authenticated attacker to execute arbitrary SQL commands via the 'temporary_files_dir' variable in interface/super/edit_globals.php.

CVE-2026-33918 [HIGH] CWE-862 CVE-2026-33918: OpenEMR is a free and open source electronic health records and medical practice management applicat OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 8.0.0.3, the billing file-download endpoint `interface/billing/get_claim_file.php` only verifies that the caller has a valid session and CSRF token, but does not check any ACL permissions. This allows any authenticated OpenEMR user

CVE-2019-3967 [MEDIUM] CWE-22 CVE-2019-3967: In OpenEMR 5.0.1 and earlier, the patient file download interface contains a directory traversal fla In OpenEMR 5.0.1 and earlier, the patient file download interface contains a directory traversal flaw that allows authenticated attackers to download arbitrary files from the host system.

CVE-2026-25164 [HIGH] CWE-862 CVE-2026-25164: OpenEMR is a free and open source electronic health records and medical practice management applicat OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 8.0.0, the REST API route table in `apis/routes/_rest_routes_standard.inc.php` does not call `RestConfig::request_authorization_check()` for the document and insurance routes. Other patient routes in the same file (e.g. encounters,

CVE-2026-33910 [HIGH] CWE-89 CVE-2026-33910: OpenEMR is a free and open source electronic health records and medical practice management applicat OpenEMR is a free and open source electronic health records and medical practice management application. Versions up to and including 8.0.0.2 contain a SQL injection vulnerability in the patient selection feature that can be exploited by authenticated attackers. The vulnerability exists due to insufficient input validation in the patient selection feat