Open-Emr Openemr vulnerabilities

CVE-2022-4506 [HIGH] CWE-434 CVE-2022-4506: Unrestricted Upload of File with Dangerous Type in GitHub repository openemr/openemr prior to 7.0.0. Unrestricted Upload of File with Dangerous Type in GitHub repository openemr/openemr prior to 7.0.0.2.

CVE-2019-16404 [HIGH] CWE-89 CVE-2019-16404: Authenticated SQL Injection in interface/forms/eye_mag/js/eye_base.php in OpenEMR through 5.0.2 allo Authenticated SQL Injection in interface/forms/eye_mag/js/eye_base.php in OpenEMR through 5.0.2 allows a user to extract arbitrary data from the openemr database via a non-parameterized INSERT INTO statement, as demonstrated by the providerID parameter.

CVE-2022-1181 [MEDIUM] CWE-79 CVE-2022-1181: Stored Cross Site Scripting in GitHub repository openemr/openemr prior to 6.0.0.2. Stored Cross Site Scripting in GitHub repository openemr/openemr prior to 6.0.0.2.

CVE-2025-43860 [HIGH] CWE-79 CVE-2025-43860: OpenEMR is a free and open source electronic health records and medical practice management applicat OpenEMR is a free and open source electronic health records and medical practice management application. A stored cross-site scripting (XSS) vulnerability in versions prior to 7.0.3.4 allows any authenticated user with patient creation and editing privileges to inject arbitrary JavaScript code into the system by entering malicious payloads in the (1) T

CVE-2026-25146 [HIGH] CWE-200 CVE-2026-25146: OpenEMR is a free and open source electronic health records and medical practice management applicat OpenEMR is a free and open source electronic health records and medical practice management application. From 5.0.2 to before 8.0.0, there are (at least) two paths where the gateway_api_key secret value is rendered to the client in plaintext. These secret keys being leaked could result in arbitrary money movement or broad account takeover of payment g

CVE-2023-22974 [HIGH] CWE-552 CVE-2023-22974: A Path Traversal in setup.php in OpenEMR < 7.0.0 allows remote unauthenticated users to read arbitra A Path Traversal in setup.php in OpenEMR < 7.0.0 allows remote unauthenticated users to read arbitrary files by controlling a connection to an attacker-controlled MySQL server.

CVE-2023-2947 [MEDIUM] CWE-79 CVE-2023-2947: Cross-site Scripting (XSS) - Stored in GitHub repository openemr/openemr prior to 7.0.1. Cross-site Scripting (XSS) - Stored in GitHub repository openemr/openemr prior to 7.0.1.

CVE-2026-25928 [MEDIUM] CWE-22 CVE-2026-25928: OpenEMR is a free and open source electronic health records and medical practice management applicat OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.0.0.2, the DICOM zip/export feature uses a user-supplied destination or path component when creating the zip file, without sanitizing path traversal sequences (e.g. `../`). An attacker with DICOM upload/export permission can write files

CVE-2021-41843 [MEDIUM] CWE-89 CVE-2021-41843: An authenticated SQL injection issue in the calendar search function of OpenEMR 6.0.0 before patch 3 An authenticated SQL injection issue in the calendar search function of OpenEMR 6.0.0 before patch 3 allows an attacker to read data from all tables of the database via the parameter provider_id, as demonstrated by the /interface/main/calendar/index.php?module=PostCalendar&func=search URI.

CVE-2023-2943 [HIGH] CWE-94 CVE-2023-2943: Code Injection in GitHub repository openemr/openemr prior to 7.0.1. Code Injection in GitHub repository openemr/openemr prior to 7.0.1.

CVE-2026-46518 [HIGH] CWE-79 CVE-2026-46518: OpenEMR is a free and open source electronic health records and medical practice management applicat OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 8.0.0.1, a stored cross-site scripting vulnerability in the prescription CSS/HTML multi-print feature allows a patient portal user to execute arbitrary JavaScript in a clinician's browser session. Patient demographic fields (name, a

CVE-2022-25471 [HIGH] CWE-639 CVE-2022-25471: An Insecure Direct Object Reference (IDOR) vulnerability in OpenEMR 6.0.0 allows any authenticated a An Insecure Direct Object Reference (IDOR) vulnerability in OpenEMR 6.0.0 allows any authenticated attacker to access and modify unauthorized areas via a crafted POST request to /modules/zend_modules/public/Installer/register.

CVE-2018-17181 [CRITICAL] CWE-89 CVE-2018-17181: An issue was discovered in OpenEMR before 5.0.1 Patch 7. SQL Injection exists in the SaveAudit funct An issue was discovered in OpenEMR before 5.0.1 Patch 7. SQL Injection exists in the SaveAudit function in /portal/lib/paylib.php and the portalAudit function in /portal/lib/appsql.class.php.

CVE-2026-25476 [HIGH] CWE-613 CVE-2026-25476: OpenEMR is a free and open source electronic health records and medical practice management applicat OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 8.0.0, the session expiration check in `library/auth.inc.php` runs only when `skip_timeout_reset` is not present in the request. When `skip_timeout_reset=1` is sent, the entire block that calls `SessionTracker::isSessionExpired()`

CVE-2026-24908 [MEDIUM] CWE-89 CVE-2026-24908: OpenEMR is a free and open source electronic health records and medical practice management applicat OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 8.0.0, an SQL injection vulnerability in the Patient REST API endpoint allows authenticated users with API access to execute arbitrary SQL queries through the `_sort` parameter. This could potentially lead to database access, PHI

CVE-2022-2493 [HIGH] CWE-1083 CVE-2022-2493: Data Access from Outside Expected Data Manager Component in GitHub repository openemr/openemr prior Data Access from Outside Expected Data Manager Component in GitHub repository openemr/openemr prior to 7.0.0.

CVE-2025-32794 [HIGH] CWE-79 CVE-2025-32794: OpenEMR is a free and open source electronic health records and medical practice management applicat OpenEMR is a free and open source electronic health records and medical practice management application. A stored cross-site scripting (XSS) vulnerability in versions prior to 7.0.3.4 allows any authenticated user with patient creation privileges to inject arbitrary JavaScript code into the system by entering malicious payloads in the First and Last Na

CVE-2026-33346 [HIGH] CWE-79 CVE-2026-33346: OpenEMR is a free and open source electronic health records and medical practice management applicat OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.0.0.2, a stored cross-site scripting (XSS) vulnerability in the patient portal payment flow allows a patient portal user to persist arbitrary JavaScript that executes in the browser of a staff member who reviews the payment submission. Th

CVE-2021-25919 [MEDIUM] CWE-79 CVE-2021-25919: In OpenEMR, versions 5.0.2 to 6.0.0 are vulnerable to Stored Cross-Site-Scripting (XSS) due to user In OpenEMR, versions 5.0.2 to 6.0.0 are vulnerable to Stored Cross-Site-Scripting (XSS) due to user input not being validated properly. A highly privileged attacker could inject arbitrary code into input fields when creating a new user.

CVE-2021-25923 [HIGH] CWE-521 CVE-2021-25923: In OpenEMR, versions 5.0.0 to 6.0.0.1 are vulnerable to weak password requirements as it does not en In OpenEMR, versions 5.0.0 to 6.0.0.1 are vulnerable to weak password requirements as it does not enforce a maximum password length limit. If a malicious user is aware of the first 72 characters of the victim user’s password, he can leverage it to an account takeover.