{"id":"CVE-2021-40352","aliases":["EUVD-2021-27530","GHSA-vrxh-2fg8-68v6"],"status":"published","title":"OpenEMR 6.0.0 has a pnotes_print.php?noteid= Insecure Direct Object Reference vulnerability via...","description":"OpenEMR 6.0.0 has a pnotes_print.php?noteid= Insecure Direct Object Reference vulnerability via which an attacker can read the messages of all users.","severity":{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-12","score":0.09709,"percentile":0.95581,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":false},"cwes":["CWE-532","CWE-639"],"published":"2021-09-01T12:20:41Z","modified":"2026-10-24T10:31:04Z","exploits":[{"source":"exploitdb","id":"EDB-50260","title":"OpenEMR 6.0.0 - 'noteid' Insecure Direct Object Reference (IDOR)","type":"webapps","platform":"php","date":"2021-09-06","url":"https://www.exploit-db.com/exploits/50260"},{"source":"pocgithub","id":"allenenosh/CVE-2021-40352","title":"allenenosh/CVE-2021-40352","date":"2021-09-01","url":"https://github.com/allenenosh/CVE-2021-40352"}],"products":[{"vendor":"open-emr","product":"openemr"}],"references":[{"url":"https://www.open-emr.org/wiki/index.php/Securing_OpenEMR","tags":["x_refsource_MISC","x_transferred","Product","Vendor Advisory","advisory"]},{"url":"https://github.com/allenenosh/CVE-2021-40352","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","evidence"]},{"url":"http://packetstormsecurity.com/files/164011/OpenEMR-6.0.0-Insecure-Direct-Object-Reference.html","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","VDB Entry","evidence"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-40352"},{"url":"https://github.com/advisories/GHSA-vrxh-2fg8-68v6"}],"sources":{"cve":[{"id":"CVE-2021-40352","description":"OpenEMR 6.0.0 has a pnotes_print.php?noteid= Insecure Direct Object Reference vulnerability via which an attacker can read the messages of all users.","status":"published","published":"2021-09-01T12:20:41Z","modified":"2024-08-04T02:44:09.48Z","updated_at":"2026-11-02T14:33:01.852999Z"}],"euvd":[{"id":"EUVD-2021-27530","description":"OpenEMR 6.0.0 has a pnotes_print.php?noteid= Insecure Direct Object Reference vulnerability via which an attacker can read the messages of all users.","status":"published","published":"2021-09-01T12:20:41Z","modified":"2024-08-04T02:44:09Z","updated_at":"2026-11-03T03:24:20.862157Z"}],"ghsa":[{"id":"GHSA-vrxh-2fg8-68v6","title":"OpenEMR 6.0.0 has a pnotes_print.php?noteid= Insecure Direct Object Reference vulnerability via...","description":"OpenEMR 6.0.0 has a pnotes_print.php?noteid= Insecure Direct Object Reference vulnerability via which an attacker can read the messages of all users.","status":"published","published":"2022-05-24T19:12:48Z","modified":"2023-01-30T05:01:51Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-532","CWE-639"],"updated_at":"2026-11-02T14:46:30.304291Z"}],"nvd":[{"id":"CVE-2021-40352","description":"OpenEMR 6.0.0 has a pnotes_print.php?noteid= Insecure Direct Object Reference vulnerability via which an attacker can read the messages of all users.","status":"published","published":"2021-09-01T13:15:08.6Z","modified":"2026-06-17T04:06:46.827Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":4,"vector":"AV:N/AC:L/Au:S/C:P/I:N/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-639"],"updated_at":"2026-11-02T14:06:57.67549Z"}],"osv":[{"id":"CVE-2021-40352","description":"OpenEMR 6.0.0 has a pnotes_print.php?noteid= Insecure Direct Object Reference vulnerability via which an attacker can read the messages of all users.","status":"published","published":"2021-09-01T13:15:08.6Z","modified":"2026-10-24T10:31:04.186791808Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:44:21.249056Z"}]}}