Export limit exceeded: 425757 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (425757 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-126457 | 1 Open-emr | 1 Openemr | 2026-11-13 | 6.5 Medium |
| OpenEMR before 8.5.0 contains a missing authorization vulnerability in InstallerController that allows any authenticated user to modify module administration settings without the admin/manage_modules permission. Low-privileged users such as Front Office clerks can POST to saveConfig, DeleteAcl, DeleteHooks and nickName actions to reconfigure or partially disable installed modules. | ||||
| CVE-2026-126458 | 1 Open-emr | 1 Openemr | 2026-11-13 | 8.8 High |
| OpenEMR before 8.5.0 contains a missing authorization vulnerability in authorizations_full.php that allows any authenticated staff user to authorize arbitrary patients' clinical records. Attackers can send a mode=authorize request with an attacker-chosen pid and their own CSRF token to set authorized=1 on billing, forms, pnotes, and transactions records, bypassing provider review. | ||||
| CVE-2026-126460 | 1 Open-emr | 1 Openemr | 2026-11-13 | 7.1 High |
| OpenEMR before 8.5.0 contains a persistent SQL injection vulnerability in SLEOB::slInvoiceNumber(), where the CLP01 claim control number from uploaded X12 835 ERA files is concatenated unescaped into a query. Attackers with billing write access can upload a crafted .edi file via sl_eob_search.php that is stored on the server and re-executes a time-based payload whenever it is reprocessed through sl_eob_process.php, extracting patient health information. | ||||
| CVE-2026-126461 | 1 Open-emr | 1 Openemr | 2026-11-13 | 6.5 Medium |
| OpenEMR before 8.5.0 contains a missing authorization vulnerability in library/ajax/user_settings.php that lets any authenticated user persist arbitrary global configuration overrides. Attackers can POST global:-prefixed keys to re-point external service hosts like CouchDB, eRx, phiMail, or SMTP to attacker-controlled servers, exfiltrating system credentials and patient PHI. | ||||
| CVE-2026-126462 | 1 Open-emr | 1 Openemr | 2026-11-13 | 5.4 Medium |
| OpenEMR before 8.5.0 contains a stored cross-site scripting vulnerability that allows authenticated users with Eye Exam edit permission to inject scripts via the Next Visit Orders PLAN[] field. Attackers can store a payload closing the textarea in view.php, executing JavaScript when another user opens the Eye Exam editor to steal session identifiers or clinical data. | ||||
| CVE-2026-126463 | 1 Open-emr | 1 Openemr | 2026-11-13 | 7.1 High |
| OpenEMR before 8.5.0 contains multiple sql injection vulnerabilities that allow authenticated users to inject payloads through ERA CLP01, form_facility, form_icd_codes, and POST key names. Attackers can perform UNION, blind, and error-based injection to read users_secure password hashes and patient PHI, and overwrite patient_data fields. | ||||
| CVE-2026-126464 | 1 Open-emr | 1 Openemr | 2026-11-13 | 4.3 Medium |
| OpenEMR before 8.5.0 contains a server-side request forgery vulnerability in PatientPortalPDFDocumentCreator::createPdfObject() that allows authenticated patients to make the server issue HTTP GET requests. Attackers can submit img src, inline style url(), or reinserted unpurified style blocks via the content parameter of portal/lib/doc_lib.php to probe internal ports and cloud metadata endpoints. | ||||
| CVE-2026-126465 | 1 Open-emr | 1 Openemr | 2026-11-13 | 6.5 Medium |
| OpenEMR before 8.5.0 contains an SQL injection vulnerability in the patient portal api/onsiteactivityviews endpoint that allows any authenticated staff user to inject SQL through unquoted Id_BitwiseAnd Criteria values. Attackers can close the bitwise parenthesis and append OR or UNION SELECT clauses to read patient PHI, staff password hashes, MySQL authentication strings, and API tokens. | ||||
| CVE-2026-126466 | 1 Open-emr | 1 Openemr | 2026-11-13 | 8.8 High |
| OpenEMR before 8.5.0 contains a missing authorization vulnerability that allows any authenticated user to create patient records and enumerate patients by omitting aclCheckCore() checks. Attackers can POST to new_comprehensive_save.php to create patients with insurance PHI, or query new_search_popup.php and patient_select.php to leak names, SSNs and DOBs. | ||||
| CVE-2026-126467 | 1 Open-emr | 1 Openemr | 2026-11-13 | 6.5 Medium |
| OpenEMR before 8.5.0 contains a mass assignment vulnerability in ObservationController::processEnhancedFormSave() that allows authenticated low-privilege users to forge authorization flags through an incomplete field blacklist. Attackers can submit authorized=1 or override the id field alongside observation_id to mark observations as Provider-signed and overwrite clinical fields of other observations within the same patient encounter. | ||||
| CVE-2026-126468 | 1 Open-emr | 1 Openemr | 2026-11-13 | 8.8 High |
| OpenEMR before 8.5.0 contains a missing authorization vulnerability that allows any authenticated low-privilege user to access reports, dated reminders, and batch reminder endpoints lacking AclMain::aclCheckCore() checks. Attackers can request patient_list.php, amc_full_report.php, dated_reminders_add.php, or batch_reminders.php directly to export patient PHI, send unauthorized reminders, and trigger batch reminder processing. | ||||
| CVE-2026-126469 | 1 Open-emr | 1 Openemr | 2026-11-13 | 8.8 High |
| OpenEMR before 8.5.0 contains a missing authorization vulnerability in several custom/ scripts that rely only on session authentication and never call AclMain::aclCheckCore(). Any authenticated low-privilege user can request export_labworks.php, chart_tracker.php, or export_registry_xml.php to disclose patient SSN, DOB, and insurance data or provider NPI/tax IDs, and forge chart-tracker records. | ||||
| CVE-2026-126470 | 1 Open-emr | 1 Openemr | 2026-11-13 | 8.8 High |
| OpenEMR before 8.5.0 contains an insecure direct object reference vulnerability in the Carecoordination module that allows authenticated users with send_to_hie permission to access any patient's CCDA/CCR/QRDA documents. Attackers can supply arbitrary document or patient IDs to download, transmit, or export patient health records, inject falsified clinical data, and delete audit records. | ||||
| CVE-2026-126471 | 1 Open-emr | 1 Openemr | 2026-11-13 | 6.5 Medium |
| OpenEMR before 8.5.0 contains a missing authorization vulnerability in print_referral.php and trend_form.php that allows low-privileged Front Office users to access patient PHI without patients:med permission. Attackers can directly request these endpoints with arbitrary patient_id values to retrieve patient demographics, insurance data, and vitals history, enumerating IDs to expand disclosure. | ||||
| CVE-2026-126472 | 1 Open-emr | 1 Openemr | 2026-11-13 | 8.8 High |
| OpenEMR before 8.5.0 contains a missing authorization vulnerability in ccdaservice/ccda_gateway.php that allows any authenticated low-privilege staff user to retrieve other patients' C-CDA documents. Attackers can request the view or dl action with sequential pid values and their own CSRF token to enumerate and exfiltrate medications, problems, allergies, and immunizations. | ||||
| CVE-2026-126473 | 1 Open-emr | 1 Openemr | 2026-11-13 | 9.1 Critical |
| OpenEMR before 8.4.0 contains OAuth scope canonicalization and containment flaws that allow unauthenticated attackers to obtain unapproved system-level FHIR access. Attackers can register a colon-form system:Patient.read client that bypasses approval, then request unregistered system/Patient.write scope to read, modify, and create Patient records. | ||||
| CVE-2026-126474 | 1 Open-emr | 1 Openemr | 2026-11-13 | 6.1 Medium |
| OpenEMR before 8.5.0 contains a reflected cross-site scripting vulnerability in the ACL module that allows attackers to execute JavaScript in authenticated sessions via the module_id parameter. Attackers can deliver crafted acl/index or acl/acl links that inject unencoded input into inline script blocks, stealing non-HttpOnly session cookies and modifying ACL configuration. | ||||
| CVE-2026-126475 | 1 Open-emr | 1 Openemr | 2026-11-13 | 6.1 Medium |
| OpenEMR before 8.5.0 contains a reflected cross-site scripting vulnerability that allows authenticated attackers to execute JavaScript by injecting payloads into the searchEleNo POST parameter of the application/index/search endpoint. Attackers can break out of unencoded HTML attributes in auto-suggest.phtml to inject event handlers that fire on DOM insertion, stealing non-HttpOnly session cookies and patient data. | ||||
| CVE-2026-126476 | 1 Open-emr | 1 Openemr | 2026-11-13 | 6.1 Medium |
| OpenEMR before 8.5.0 contains a reflected cross-site scripting vulnerability in the Application module's auto-suggest endpoint, which echoes the searchMode POST parameter unencoded into a single-quoted onClick attribute. Attackers can induce an authenticated user to submit a single-quote payload to application/index/search, executing arbitrary JavaScript in that user's session to steal session cookies or disclose patient data. | ||||
| CVE-2026-126477 | 1 Open-emr | 1 Openemr | 2026-11-13 | 4.8 Medium |
| OpenEMR before 8.5.0 contains a stored cross-site scripting vulnerability in the Eye Exam (eye_mag) module that allows administrators to inject JavaScript through unencoded Eye_defaults list option titles. Attackers can store a crafted title via edit_list.php that breaks out of a jQuery string in eye_base.php, executing script in any authenticated user's session when they click Defaults. | ||||