Skip to contentOpenemr Openemr vulnerabilities
- open-emr openemrOpenEMR: Missing authorization on QRDA Category I/III download endpointsCVE-2026-1041386.5 Medium
- open-emr openemrOpenEMR: Broken Access Control in controller.php Enables Insurance Routing Credential Hijack and PHI EnumerationCVE-2026-1155738.1 High
- open-emr openemrOpenEMR: Missing authorization in DORN `compendium_install.php` — non-admin destructive lab-compendium reinstallCVE-2026-1041337.1 High
- open-emr openemrOpenEMR: Stored XSS via `text()` Misuse in Double-Quoted HTML AttributeCVE-2026-1039358.1 High
- open-emr openemrOpenEMR: Missing authorization in payment patient-search AJAX leaks patient directory and dates of birthCVE-2026-1041356.5 Medium
- open-emr openemrOpenEMR: Arbitrary Patient Recall and Contact Detail ReadCVE-2026-1041367.1 High
- open-emr openemrOpenEMR: CSRF Protection Bypass on IPPF Point-of-Sale Void and Regen OperationsCVE-2026-1039387.1 High
- open-emr openemrOpenEMR: Patient Data Search Without Sufficient ACLCVE-2026-1041377.1 High
- open-emr openemrOpenEMR: Missing Authorization on Document Template Download Endpoint Allows Any Authenticated User to Read Another Patient's PHICVE-2026-1041396.5 Medium
- open-emr openemrOpenEMR FaxSMS module: insecure staging of decrypted patient documents in webrootCVE-2026-659837.5 High
- open-emr openemrOpenEMR Before 8.5.0 SQL Injection via form_icd_codes[]CVE-2026-491428.7 High
- open-emr openemrOpenEMR < 8.3.0 Path Traversal Information Disclosure via EDI Archive RestoreCVE-2026-766145.3 Medium
- open-emr openemrOpenEMR < 8.3.0 CSRF via DICOM Viewer web_path ParameterCVE-2026-405095.3 Medium
- open-emr openemrOpenEMR < 8.3.0 Stored XSS via Patient Portal Template Import HandlerCVE-2026-405085.1 Medium
- open-emr openemrOpenEMR < 8.3.0 Reflected XSS via templateHtml Parameter in Patient PortalCVE-2026-405075.1 Medium
- open-emr openemrOpenEMR Path Traversal Arbitrary Directory Deletion via standard_tables_manage.phpCVE-2026-405067.0 High
- open-emr openemrOpenEMR 8.2.0 Stored XSS via import_template.php Template ManagementCVE-2026-676124.8 Medium
- open-emr openemrOpenEMR 8.2.0 OAuth2 Password Grant Authentication Bypass via SMART ConfigurationCVE-2026-676118.6 High
- open-emr openemrOpenEMR 8.2.0 OAuth2 Dynamic Client Registration Unauthorized FHIR AccessCVE-2026-676108.6 High
- open-emr openemrOpenEMR 8.2.0 Remote Code Execution via CategoryTree eval() InjectionCVE-2026-399329.4 Critical
- open-emr openemrOpenEMR Authenticated SQL Injection via backup.php Import FeatureCVE-2026-399318.6 High
- open-emr openemrOpenEMR: Stored XSS in prescription CSS/HTML print view via patient demographicsCVE-2026-465187.7 High
- open-emr openemrOpenEMR has a Privilege Escalation that Allows a Low-Level User to View Admin-Only DataCVE-2026-340567.7 High
- open-emr openemrOpenEMR has IDOR in Patient Notes Web UI allows unauthorized note access/modificationCVE-2026-340558.1 High
- open-emr openemrOpenEMR Missing Authorization in Procedure Order AJAX Deletion HandlerCVE-2026-340537.1 High
- open-emr openemrOpenEMR has Improper ACL On Import/Export PopupCVE-2026-340515.4 Medium
- open-emr openemrOpenEMR's Missing Authorization in show-signature.php Allows Portal Patients to Read Staff SignaturesCVE-2026-339344.3 Medium
- open-emr openemrReflected XSS via Unescaped contextName Parameter in Custom Template EditorCVE-2026-339336.1 Medium
- open-emr openemrOpenEMR has Stored XSS in CCDA Preview via Unsanitized linkHtml AttributesCVE-2026-339327.6 High
- open-emr openemrOpenEMR has IDOR in Portal Payment Page that Allows Cross-Patient Record AccessCVE-2026-339316.5 Medium
- open-emr openemrOpenEMR Missing Authorization on Claim File Download EndpointCVE-2026-339187.6 High
- open-emr openemrOpenEMR has SQL Injection in CAMOS FormCVE-2026-33917Public exploit8.8 High
- open-emr openemrOpenEMR Missing ACL Checks on Insurance Company API RoutesCVE-2026-339155.4 Medium
- open-emr openemrOpenEMR has SQL Injection in PostCalendar Category DeleteCVE-2026-339147.2 High
- open-emr openemrOpenEMR: XInclude Injection in CCDA Import Allows Reading Arbitrary Server FilesCVE-2026-339137.7 High
- open-emr openemrOpenEMR has reflected XSS in ajax_download.php via reportID parameterCVE-2026-339125.4 Medium
- open-emr openemrOpenEMR vulnerable to reflected XSS in graphs.php via title parameterCVE-2026-339115.4 Medium
- open-emr openemrOpenEMR has a SQL Injection Vulnerability in patient selectionCVE-2026-33910Public exploit7.2 High
- open-emr openemrOpenEMR Vulnerable to SQL Injection via Unsanitized Variables in MedEx Recall/Reminder ProcessingCVE-2026-339095.9 Medium
- open-emr openemrOpenEMR has Stored XSS in patient encounter Eye Exam form $CHRONIC2 and $CHRONIC3CVE-2026-333488.7 High
- open-emr openemrOpenEMR has IDOR in Fee Sheet Product SaveCVE-2026-321206.5 Medium
- open-emr openemrOpenEMR Vulnerable to Authenticated Blind Boolean-Based SQL Injection in new_search_popup.phpCVE-2026-29187Public exploit8.1 High
- open-emr openemrOpenEMR has stored XSS in portal_payment.php via Unescaped table_argsCVE-2026-333468.7 High
- open-emr openemrOpenEMR has Authorization Bypass in FaxSMS AppDispatch ConstructorCVE-2026-333055.4 Medium
- open-emr openemrOpenEMR has Authorization Bypass in Dated Reminders LogCVE-2026-333046.5 Medium
- open-emr openemrOpenEMR Vulnerable to Stored XSS via Unescaped portal_login_username in Credential Print ViewCVE-2026-333035.4 Medium
- open-emr openemrOpenEMR: zhAclCheck Ignores Explicit ACL DeniesCVE-2026-333027.3 High
- open-emr openemrOpenEMR has Out-of-Band Server-Side Request Forgery (OOB SSRF)CVE-2026-333217.2 High
- open-emr openemrOpenEMR has arbitrary image file read via PDF generatorCVE-2026-333017.1 High
- open-emr openemrOpenEMR has Stored XSS in patient encounter Eye Exam form answersCVE-2026-332998.5 High
- Show moreLoading…