Skip to content
Openemr vulnerabilities
Newest
-
open-emr openemr
OpenEMR: Missing Write ACL Allows Unauthorized Document Reassignment
CVE-2026-102940
9.6 Critical
-
open-emr openemr
OpenEMR: Username Enumeration via Pre-Authentication User Settings Loading
CVE-2026-103021
5.3 Medium
-
open-emr openemr
OpenEMR: Unauthenticated Information Disclosure in admin.php Exposes Database Names and Versions
CVE-2026-103020
5.3 Medium
-
open-emr openemr
OpenEMR: Unauthenticated Open Redirect via OIDC End Session Endpoint
CVE-2026-103019
4.3 Medium
-
open-emr openemr
OpenEMR: Missing authorization in person-search AJAX leaks patient demographics (name, DOB, phone, email)
CVE-2026-104134
6.5 Medium
-
open-emr openemr
OpenEMR: Weno `file_download.php`: missing ACL/CSRF truncates the e-prescribing pharmacy directory
CVE-2026-103939
5.4 Medium
-
open-emr openemr
OpenEMR: Missing authorization on QRDA Category I/III download endpoints
CVE-2026-104138
6.5 Medium
-
open-emr openemr
OpenEMR: Broken Access Control in controller.php Enables Insurance Routing Credential Hijack and PHI Enumeration
CVE-2026-115573
8.1 High
-
open-emr openemr
OpenEMR: Missing authorization in DORN `compendium_install.php` — non-admin destructive lab-compendium reinstall
CVE-2026-104133
7.1 High
-
open-emr openemr
OpenEMR: Stored XSS via `text()` Misuse in Double-Quoted HTML Attribute
CVE-2026-103935
8.1 High
-
open-emr openemr
OpenEMR: Missing authorization in payment patient-search AJAX leaks patient directory and dates of birth
CVE-2026-104135
6.5 Medium
-
open-emr openemr
OpenEMR: Arbitrary Patient Recall and Contact Detail Read
CVE-2026-104136
7.1 High
-
open-emr openemr
OpenEMR: CSRF Protection Bypass on IPPF Point-of-Sale Void and Regen Operations
CVE-2026-103938
7.1 High
-
open-emr openemr
OpenEMR: Patient Data Search Without Sufficient ACL
CVE-2026-104137
7.1 High
-
open-emr openemr
OpenEMR: Missing Authorization on Document Template Download Endpoint Allows Any Authenticated User to Read Another Patient's PHI
CVE-2026-104139
6.5 Medium
-
open-emr openemr
OpenEMR FaxSMS module: insecure staging of decrypted patient documents in webroot
CVE-2026-65983
7.5 High
-
open-emr openemr
OpenEMR Before 8.5.0 SQL Injection via form_icd_codes[]
CVE-2026-49142
8.7 High
-
open-emr openemr
OpenEMR < 8.3.0 Path Traversal Information Disclosure via EDI Archive Restore
CVE-2026-76614
5.3 Medium
-
open-emr openemr
OpenEMR < 8.3.0 CSRF via DICOM Viewer web_path Parameter
CVE-2026-40509
5.3 Medium
-
open-emr openemr
OpenEMR < 8.3.0 Stored XSS via Patient Portal Template Import Handler
CVE-2026-40508
5.1 Medium
-
open-emr openemr
OpenEMR < 8.3.0 Reflected XSS via templateHtml Parameter in Patient Portal
CVE-2026-40507
5.1 Medium
-
open-emr openemr
OpenEMR Path Traversal Arbitrary Directory Deletion via standard_tables_manage.php
CVE-2026-40506
7.0 High
-
open-emr openemr
OpenEMR 8.2.0 Stored XSS via import_template.php Template Management
CVE-2026-67612
4.8 Medium
-
open-emr openemr
OpenEMR 8.2.0 OAuth2 Password Grant Authentication Bypass via SMART Configuration
CVE-2026-67611
8.6 High
-
open-emr openemr
OpenEMR 8.2.0 OAuth2 Dynamic Client Registration Unauthorized FHIR Access
CVE-2026-67610
8.6 High
-
open-emr openemr
OpenEMR 8.2.0 Remote Code Execution via CategoryTree eval() Injection
CVE-2026-39932
9.4 Critical
-
open-emr openemr
OpenEMR Authenticated SQL Injection via backup.php Import Feature
CVE-2026-39931
8.6 High
-
open-emr openemr
OpenEMR: Stored XSS in prescription CSS/HTML print view via patient demographics
CVE-2026-46518
7.7 High
-
open-emr openemr
OpenEMR has a Privilege Escalation that Allows a Low-Level User to View Admin-Only Data
CVE-2026-34056
7.7 High
-
open-emr openemr
OpenEMR has IDOR in Patient Notes Web UI allows unauthorized note access/modification
CVE-2026-34055
8.1 High
-
open-emr openemr
OpenEMR Missing Authorization in Procedure Order AJAX Deletion Handler
CVE-2026-34053
7.1 High
-
open-emr openemr
OpenEMR has Improper ACL On Import/Export Popup
CVE-2026-34051
5.4 Medium
-
open-emr openemr
OpenEMR's Missing Authorization in show-signature.php Allows Portal Patients to Read Staff Signatures
CVE-2026-33934
4.3 Medium
-
open-emr openemr
Reflected XSS via Unescaped contextName Parameter in Custom Template Editor
CVE-2026-33933
6.1 Medium
-
open-emr openemr
OpenEMR has Stored XSS in CCDA Preview via Unsanitized linkHtml Attributes
CVE-2026-33932
7.6 High
-
open-emr openemr
OpenEMR has IDOR in Portal Payment Page that Allows Cross-Patient Record Access
CVE-2026-33931
6.5 Medium
-
open-emr openemr
OpenEMR Missing Authorization on Claim File Download Endpoint
CVE-2026-33918
7.6 High
-
open-emr openemr
OpenEMR has SQL Injection in CAMOS Form
CVE-2026-33917
Public exploit
8.8 High
-
open-emr openemr
OpenEMR Missing ACL Checks on Insurance Company API Routes
CVE-2026-33915
5.4 Medium
-
open-emr openemr
OpenEMR has SQL Injection in PostCalendar Category Delete
CVE-2026-33914
7.2 High
-
open-emr openemr
OpenEMR: XInclude Injection in CCDA Import Allows Reading Arbitrary Server Files
CVE-2026-33913
7.7 High
-
open-emr openemr
OpenEMR has reflected XSS in ajax_download.php via reportID parameter
CVE-2026-33912
5.4 Medium
-
open-emr openemr
OpenEMR vulnerable to reflected XSS in graphs.php via title parameter
CVE-2026-33911
5.4 Medium
-
open-emr openemr
OpenEMR has a SQL Injection Vulnerability in patient selection
CVE-2026-33910
Public exploit
7.2 High
-
open-emr openemr
OpenEMR Vulnerable to SQL Injection via Unsanitized Variables in MedEx Recall/Reminder Processing
CVE-2026-33909
5.9 Medium
-
open-emr openemr
OpenEMR has Stored XSS in patient encounter Eye Exam form $CHRONIC2 and $CHRONIC3
CVE-2026-33348
8.7 High
-
open-emr openemr
OpenEMR has IDOR in Fee Sheet Product Save
CVE-2026-32120
6.5 Medium
-
open-emr openemr
OpenEMR Vulnerable to Authenticated Blind Boolean-Based SQL Injection in new_search_popup.php
CVE-2026-29187
Public exploit
8.1 High
-
open-emr openemr
OpenEMR has stored XSS in portal_payment.php via Unescaped table_args
CVE-2026-33346
8.7 High
-
open-emr openemr
OpenEMR has Authorization Bypass in FaxSMS AppDispatch Constructor
CVE-2026-33305
5.4 Medium
- Show olderLoading…