Export limit exceeded: 425490 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 425490 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 425490 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 425490 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 425490 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 425490 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 425490 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 425490 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 425490 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 425490 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 425490 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 425490 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 425490 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 425490 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 425490 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 425490 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 425490 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 425490 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (425490 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-126467 | 1 Open-emr | 1 Openemr | 2026-11-13 | 6.5 Medium |
| OpenEMR before 8.5.0 contains a mass assignment vulnerability in ObservationController::processEnhancedFormSave() that allows authenticated low-privilege users to forge authorization flags through an incomplete field blacklist. Attackers can submit authorized=1 or override the id field alongside observation_id to mark observations as Provider-signed and overwrite clinical fields of other observations within the same patient encounter. | ||||
| CVE-2026-126468 | 1 Open-emr | 1 Openemr | 2026-11-13 | 8.8 High |
| OpenEMR before 8.5.0 contains a missing authorization vulnerability that allows any authenticated low-privilege user to access reports, dated reminders, and batch reminder endpoints lacking AclMain::aclCheckCore() checks. Attackers can request patient_list.php, amc_full_report.php, dated_reminders_add.php, or batch_reminders.php directly to export patient PHI, send unauthorized reminders, and trigger batch reminder processing. | ||||
| CVE-2026-126469 | 1 Open-emr | 1 Openemr | 2026-11-13 | 8.8 High |
| OpenEMR before 8.5.0 contains a missing authorization vulnerability in several custom/ scripts that rely only on session authentication and never call AclMain::aclCheckCore(). Any authenticated low-privilege user can request export_labworks.php, chart_tracker.php, or export_registry_xml.php to disclose patient SSN, DOB, and insurance data or provider NPI/tax IDs, and forge chart-tracker records. | ||||
| CVE-2026-126470 | 1 Open-emr | 1 Openemr | 2026-11-13 | 8.8 High |
| OpenEMR before 8.5.0 contains an insecure direct object reference vulnerability in the Carecoordination module that allows authenticated users with send_to_hie permission to access any patient's CCDA/CCR/QRDA documents. Attackers can supply arbitrary document or patient IDs to download, transmit, or export patient health records, inject falsified clinical data, and delete audit records. | ||||
| CVE-2026-126471 | 1 Open-emr | 1 Openemr | 2026-11-13 | 6.5 Medium |
| OpenEMR before 8.5.0 contains a missing authorization vulnerability in print_referral.php and trend_form.php that allows low-privileged Front Office users to access patient PHI without patients:med permission. Attackers can directly request these endpoints with arbitrary patient_id values to retrieve patient demographics, insurance data, and vitals history, enumerating IDs to expand disclosure. | ||||
| CVE-2026-126472 | 1 Open-emr | 1 Openemr | 2026-11-13 | 8.8 High |
| OpenEMR before 8.5.0 contains a missing authorization vulnerability in ccdaservice/ccda_gateway.php that allows any authenticated low-privilege staff user to retrieve other patients' C-CDA documents. Attackers can request the view or dl action with sequential pid values and their own CSRF token to enumerate and exfiltrate medications, problems, allergies, and immunizations. | ||||
| CVE-2026-126473 | 1 Open-emr | 1 Openemr | 2026-11-13 | 9.1 Critical |
| OpenEMR before 8.4.0 contains OAuth scope canonicalization and containment flaws that allow unauthenticated attackers to obtain unapproved system-level FHIR access. Attackers can register a colon-form system:Patient.read client that bypasses approval, then request unregistered system/Patient.write scope to read, modify, and create Patient records. | ||||
| CVE-2026-126474 | 1 Open-emr | 1 Openemr | 2026-11-13 | 6.1 Medium |
| OpenEMR before 8.5.0 contains a reflected cross-site scripting vulnerability in the ACL module that allows attackers to execute JavaScript in authenticated sessions via the module_id parameter. Attackers can deliver crafted acl/index or acl/acl links that inject unencoded input into inline script blocks, stealing non-HttpOnly session cookies and modifying ACL configuration. | ||||
| CVE-2026-126475 | 1 Open-emr | 1 Openemr | 2026-11-13 | 6.1 Medium |
| OpenEMR before 8.5.0 contains a reflected cross-site scripting vulnerability that allows authenticated attackers to execute JavaScript by injecting payloads into the searchEleNo POST parameter of the application/index/search endpoint. Attackers can break out of unencoded HTML attributes in auto-suggest.phtml to inject event handlers that fire on DOM insertion, stealing non-HttpOnly session cookies and patient data. | ||||
| CVE-2026-126476 | 1 Open-emr | 1 Openemr | 2026-11-13 | 6.1 Medium |
| OpenEMR before 8.5.0 contains a reflected cross-site scripting vulnerability in the Application module's auto-suggest endpoint, which echoes the searchMode POST parameter unencoded into a single-quoted onClick attribute. Attackers can induce an authenticated user to submit a single-quote payload to application/index/search, executing arbitrary JavaScript in that user's session to steal session cookies or disclose patient data. | ||||
| CVE-2026-126477 | 1 Open-emr | 1 Openemr | 2026-11-13 | 4.8 Medium |
| OpenEMR before 8.5.0 contains a stored cross-site scripting vulnerability in the Eye Exam (eye_mag) module that allows administrators to inject JavaScript through unencoded Eye_defaults list option titles. Attackers can store a crafted title via edit_list.php that breaks out of a jQuery string in eye_base.php, executing script in any authenticated user's session when they click Defaults. | ||||
| CVE-2026-126478 | 1 Open-emr | 1 Openemr | 2026-11-13 | 7.6 High |
| OpenEMR before 8.5.0 contains an SQL injection vulnerability in the Syndromic Surveillance report because the form_icd_codes[] POST array is concatenated into an unquoted numeric IN() clause without integer validation. Authenticated users can submit quote-free payloads that bypass add_escape_custom to perform blind or UNION-based injection and exfiltrate patient health information. | ||||
| CVE-2026-126479 | 1 Open-emr | 1 Openemr | 2026-11-13 | 7.6 High |
| OpenEMR before 8.5.0 contains a missing authorization vulnerability in five Module Manager InstallerController actions that lack the admin/manage_modules ACL check and CSRF validation. Low-privilege users such as Front Office accounts can POST to saveConfig or SaveHooks to overwrite any module's configuration, retarget CCDA and HIE settings, and delete module hooks. | ||||
| CVE-2026-126480 | 1 Open-emr | 1 Openemr | 2026-11-13 | 8.1 High |
| OpenEMR before 8.5.0 contains an sql injection vulnerability in CcrTable::insertApprovedData() that allows authenticated users to inject SQL through request parameter names used as column names. Attackers can send crafted patient_data-*-sel parameters to the revandapprove route, lacking ACL and CSRF checks, to copy password hashes into patient fields or corrupt records. | ||||
| CVE-2026-126481 | 1 Open-emr | 1 Openemr | 2026-11-13 | 8.1 High |
| OpenEMR before 8.5.0 contains a path traversal vulnerability in era_payments.php and sl_eob_search.php that allows authenticated billing users to write files outside the ERA directory. Attackers can embed traversal sequences in the GS04 element of an uploaded X12 835 file to overwrite .edi or .835 files with attacker-controlled content anywhere writable by the web server. | ||||
| CVE-2026-126482 | 1 Open-emr | 1 Openemr | 2026-11-13 | 8.8 High |
| OpenEMR before 8.5.0 contains an SQL injection vulnerability in SLEOB::slInvoiceNumber() in src/Billing/SLEOB.php, which concatenates the CLP01 claim identifier from uploaded X12 835 ERA files into a query without escaping or parameter binding. Authenticated users with billing permissions, or a malicious payer whose ERA file a clerk uploads, can execute arbitrary SQL to read any table, including users_secure password hashes, and modify data. | ||||
| CVE-2026-126483 | 1 Open-emr | 1 Openemr | 2026-11-13 | 6.5 Medium |
| OpenEMR before 8.5.0 contains an SQL injection vulnerability that allows authenticated report users to manipulate queries by supplying a crafted form_facility value to interface/reports/ippf_statistics.php. Attackers can close the string literal in the facility_id WHERE clause and use boolean or time-based payloads to read sensitive database contents. | ||||
| CVE-2026-126484 | 1 Open-emr | 1 Openemr | 2026-11-13 | 5.4 Medium |
| OpenEMR before 8.5.0 contains a stored cross-site scripting vulnerability in printed_fee_sheet.php that allows authenticated portal patients to inject script by setting unescaped appointment comments (pc_hometext). Attackers can submit HTML payloads via the form_comments field in add_edit_event_user.php that execute when staff open the patient's fee sheet, acting within the staff session. | ||||
| CVE-2026-126485 | 1 Open-emr | 1 Openemr | 2026-11-13 | 4.3 Medium |
| OpenEMR before 8.5.0 contains a cross-site request forgery vulnerability in ObservationController::deleteAction that allows attackers to delete observation form records without a CSRF token. Attackers can lure a logged-in clinician to a page issuing a GET to delete.php with guessed id values, soft-deleting observations in the victim's open encounter. | ||||
| CVE-2026-126486 | 1 Open-emr | 1 Openemr | 2026-11-13 | 7.6 High |
| OpenEMR before 8.5.0 contains a missing authorization vulnerability in portal/import_template.php, where several portal document template modes lack admin/forms ACL and CSRF checks. Any authenticated staff user can send mode=save_profiles to delete all template profile assignments, use other unguarded modes to push templates to patients or change categories, and read template bodies via mode=get or getPdf. | ||||