Open-Emr Openemr vulnerabilities

CVE-2026-32127 [HIGH] CWE-89 CVE-2026-32127: OpenEMR is a free and open source electronic health records and medical practice management applicat OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.0.0.1, OpenEMR contains a SQL injection vulnerability in the ajax graphs library that can be exploited by authenticated attackers. The vulnerability exists due to insufficient input validation in the ajax graphs library. This vulnerabilit

CVE-2020-13566 [HIGH] CWE-89 CVE-2020-13566: SQL injection vulnerabilities exist in phpGACL 3.3.7. A specially crafted HTTP request can lead to a SQL injection vulnerabilities exist in phpGACL 3.3.7. A specially crafted HTTP request can lead to a SQL injection. An attacker can send an HTTP request to trigger this vulnerability In admin/edit_group.php, when the POST parameter action is “Delete”, the POST parameter delete_group leads to a SQL injection.

CVE-2026-33301 [HIGH] CWE-116 CVE-2026-33301: OpenEMR is a free and open source electronic health records and medical practice management applicat OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.0.0.2, users with the `Notes - my encounters` role can fill Eye Exam forms in patient encounters. The answers to the form can be printed out in PDF form. An arbitrary file read vulnerability was identified in the PDF creation function wh

CVE-2026-33302 [HIGH] CWE-863 CVE-2026-33302: OpenEMR is a free and open source electronic health records and medical practice management applicat OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.0.0.2, the module ACL function `AclMain::zhAclCheck()` only checks for the presence of any "allow" (user or group). It never checks for explicit "deny" (allowed=0). As a result, administrators cannot revoke access by setting a user or gr

CVE-2018-15147 [HIGH] CWE-89 CVE-2018-15147: SQL injection vulnerability in interface/forms_admin/forms_admin.php from library/registry.inc in ve SQL injection vulnerability in interface/forms_admin/forms_admin.php from library/registry.inc in versions of OpenEMR before 5.0.1.4 allows a remote authenticated attacker to execute arbitrary SQL commands via the 'id' parameter.

CVE-2021-32101 [HIGH] CWE-732 CVE-2021-32101: The Patient Portal of OpenEMR 5.0.2.1 is affected by a incorrect access control system in portal/pat The Patient Portal of OpenEMR 5.0.2.1 is affected by a incorrect access control system in portal/patient/_machine_config.php. To exploit the vulnerability, an unauthenticated attacker can register an account, bypassing the permission check of this portal's API. Then, the attacker can then manipulate and read data of every registered patient.

CVE-2026-33321 [HIGH] CWE-918 CVE-2026-33321: OpenEMR is a free and open source electronic health records and medical practice management applicat OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.0.0.2, users with the `Notes - my encounters` role can fill Eye Exam forms in patient encounters. The answers to the form can be printed out in PDF form. An Out-of-Band Server-Side Request Forgery (OOB SSRF) vulnerability was identified

CVE-2023-54347 [HIGH] CWE-307 CVE-2023-54347: OpenEMR 7.0.1 contains an authentication brute force vulnerability that allows attackers to bypass r OpenEMR 7.0.1 contains an authentication brute force vulnerability that allows attackers to bypass rate limiting protections by sending repeated login attempts to the main login endpoint. Attackers can submit POST requests with authUser and clearPass parameters to systematically test username and password combinations without account lockout restricti

CVE-2020-13569 [HIGH] CWE-352 CVE-2020-13569: A cross-site request forgery vulnerability exists in the GACL functionality of OpenEMR 5.0.2 and dev A cross-site request forgery vulnerability exists in the GACL functionality of OpenEMR 5.0.2 and development version 6.0.0 (commit babec93f600ff1394f91ccd512bcad85832eb6ce). A specially crafted HTTP request can lead to the execution of arbitrary requests in the context of the victim. An attacker can send an HTTP request to trigger this vulnerability.

CVE-2018-10573 [HIGH] CVE-2018-10573: interface/fax/fax_dispatch.php in OpenEMR before 5.0.1 allows remote authenticated users to bypass i interface/fax/fax_dispatch.php in OpenEMR before 5.0.1 allows remote authenticated users to bypass intended access restrictions via the scan parameter.

CVE-2023-22973 [HIGH] CWE-22 CVE-2023-22973: A Local File Inclusion (LFI) vulnerability in interface/forms/LBF/new.php in OpenEMR < 7.0.0 allows A Local File Inclusion (LFI) vulnerability in interface/forms/LBF/new.php in OpenEMR < 7.0.0 allows remote authenticated users to execute code via the formname parameter.

CVE-2021-32104 [HIGH] CWE-89 CVE-2021-32104: A SQL injection vulnerability exists (with user privileges) in interface/forms/eye_mag/save.php in O A SQL injection vulnerability exists (with user privileges) in interface/forms/eye_mag/save.php in OpenEMR 5.0.2.1.

CVE-2021-32102 [HIGH] CWE-89 CVE-2021-32102: A SQL injection vulnerability exists (with user privileges) in library/custom_template/ajax_code.php A SQL injection vulnerability exists (with user privileges) in library/custom_template/ajax_code.php in OpenEMR 5.0.2.1.

CVE-2026-34053 [HIGH] CWE-862 CVE-2026-34053: OpenEMR is a free and open source electronic health records and medical practice management applicat OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 8.0.0.3, missing authorization in the AJAX deletion endpoint `interface/forms/procedure_order/handle_deletions.php` allows any authenticated user, regardless of role, to irreversibly delete procedure orders, answers, and specimens

CVE-2026-32126 [HIGH] CWE-862 CVE-2026-32126: OpenEMR is a free and open source electronic health records and medical practice management applicat OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.0.0.1, an inverted boolean condition in ControllerRouter::route() causes the admin/super ACL check to be enforced only for controllers that already have their own internal authorization (review, log), while leaving all other CDR controll

CVE-2019-17197 [CRITICAL] CWE-89 CVE-2019-17197: OpenEMR through 5.0.2 has SQL Injection in the Lifestyle demographic filter criteria in library/clin OpenEMR through 5.0.2 has SQL Injection in the Lifestyle demographic filter criteria in library/clinical_rules.php that affects library/patient.inc.

CVE-2026-39931 [HIGH] CWE-434 CVE-2026-39931: OpenEMR through 8.2.0 contains an authenticated SQL injection vulnerability in the backup configurat OpenEMR through 8.2.0 contains an authenticated SQL injection vulnerability in the backup configuration import feature that allows administrators with admin or super ACL privileges to execute arbitrary DDL and DML statements against the application database by uploading a crafted SQL file at the form_step=202 parameter in backup.php. Attackers can exp

CVE-2019-3963 [MEDIUM] CWE-79 CVE-2019-3963: In OpenEMR 5.0.1 and earlier, controller.php contains a reflected XSS vulnerability in the patient_i In OpenEMR 5.0.1 and earlier, controller.php contains a reflected XSS vulnerability in the patient_id parameter. This could allow an attacker to execute arbitrary code in the context of a user's session.

CVE-2019-3964 [MEDIUM] CWE-79 CVE-2019-3964: In OpenEMR 5.0.1 and earlier, controller.php contains a reflected XSS vulnerability in the doc_id pa In OpenEMR 5.0.1 and earlier, controller.php contains a reflected XSS vulnerability in the doc_id parameter. This could allow an attacker to execute arbitrary code in the context of a user's session.

CVE-2022-1178 [MEDIUM] CWE-79 CVE-2022-1178: Stored Cross Site Scripting in GitHub repository openemr/openemr prior to 6.0.0.4. Stored Cross Site Scripting in GitHub repository openemr/openemr prior to 6.0.0.4.