Login Request a demo
OP
Product
OpenEMR
by Open-Emr · last CVE Aug 3, 2026
221
CVEs
0
On KEV
9.9
Max CVSS
0
New 30D
Vulnerabilities221In the news0Timeline
Severity mix
Critical 15High 82Medium 115Low 2
Severity
All severities221Critical15High82Medium115Low2
Exploitation
On CISA KEV0Exploited in the wild0
Watch

Add OpenEMR to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2019-8368
6.1
46%
Sep 16
OpenEMR v5.0.1-6 allows XSS
Affected: 5.0.1-6
CVE-2019-3966
6.1
1%
Aug 20
In OpenEMR 5.0.1 and earlier, controller.php contains a reflected XSS vulnerability in the foreign_id parameter
Affected: through 5.0.1
CVE-2019-3965
6.1
1%
Aug 20
In OpenEMR 5.0.1 and earlier, controller.php contains a reflected XSS vulnerability in the document_id parameter
Affected: through 5.0.1
CVE-2019-3964
6.1
53%
Aug 20
In OpenEMR 5.0.1 and earlier, controller.php contains a reflected XSS vulnerability in the doc_id parameter
Affected: through 5.0.1
CVE-2019-3963
6.1
53%
Aug 20
In OpenEMR 5.0.1 and earlier, controller.php contains a reflected XSS vulnerability in the patient_id parameter
Affected: through 5.0.1
CVE-2018-18035
6.1
1%
Apr 2
A vulnerability in flashcanvas.swf in OpenEMR before 5.0.1 Patch 6 could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack on a targeted…
Affected: before 5.0.1.6
CVE-2018-10571
6.1
1%
Apr 30
Multiple reflected cross-site scripting (XSS) vulnerabilities in OpenEMR before 5.0.1 allow remote attackers to inject arbitrary web script or HTML via the (1) patient parameter…
Affected: before 5.0.1
CVE-2018-1000020
6.1
1%
Feb 9
OpenEMR version 5.0.0 contains a Cross Site Scripting (XSS) vulnerability in open-flash-chart.swf and _posteddata.php that can result in
Affected: 5.0.0
CVE-2017-6394
6.1
1%
Mar 2
Multiple Cross-Site Scripting (XSS) issues were discovered in OpenEMR 5.0.0 and 5.0.1-dev
Affected: 5.0.1
CVE-2026-33909
5.9
0%
Mar 25
OpenEMR Vulnerable to SQL Injection via Unsanitized Variables in MedEx Recall/Reminder Processing
Affected: before 8.0.0.3
CVE-2026-34051
5.4
0%
Mar 25
OpenEMR has Improper ACL On Import/Export Popup
Affected: before 8.0.0.3
CVE-2026-33932
5.4
0%
Mar 25
OpenEMR has Stored XSS in CCDA Preview via Unsanitized linkHtml Attributes
Affected: before 8.0.0.3
CVE-2026-33915
5.4
0%
Mar 25
OpenEMR Missing ACL Checks on Insurance Company API Routes
Affected: before 8.0.0.3
CVE-2026-33912
5.4
0%
Mar 25
OpenEMR has reflected XSS in ajax_download.php via reportID parameter
Affected: before 8.0.0.3
CVE-2026-33911
5.4
0%
Mar 25
OpenEMR vulnerable to reflected XSS in graphs.php via title parameter
Affected: before 8.0.0.3
CVE-2026-33348
5.4
0%
Mar 25
OpenEMR has Stored XSS in patient encounter Eye Exam form $CHRONIC2 and $CHRONIC3
Affected: before 8.0.0.3
CVE-2026-33305
5.4
0%
Mar 19
OpenEMR has Authorization Bypass in FaxSMS AppDispatch Constructor
Affected: before 8.0.0.2
CVE-2026-33303
5.4
0%
Mar 19
OpenEMR Vulnerable to Stored XSS via Unescaped portal_login_username in Credential Print View
Affected: before 8.0.0.2
CVE-2026-33299
5.4
0%
Mar 19
OpenEMR has Stored XSS in patient encounter Eye Exam form answers
Affected: before 8.0.0.2
CVE-2026-32125
5.4
0%
Mar 11
OpenEMR: Stored XSS in Track Anything Graphs via Unescaped Dygraph Titles/Labels
Affected: before 8.0.0.1
CVE-2026-32124
5.4
0%
Mar 11
OpenEMR: Dynamic Code Picker Renders Unescaped Descriptions (Stored XSS)
Affected: before 8.0.0.1
CVE-2026-32121
5.4
0%
Mar 11
OpenEMR: Stored DOM XSS via `.html()` in Portal Signer Modal
Affected: before 8.0.0.1
CVE-2025-69231
5.4
4%
Feb 25
OpenEMR has a Stored XSS in GAD-7 Form that Enables Session Hijacking and Privilege Escalation
Affected: before 8.0.0
CVE-2025-67491
5.4
0%
Feb 25
OpenEMR has Stored XSS in ub04 helper
Affected: 5.0.0.5 before 7.0.4
CVE-2021-47817
5.4
1%
Jan 21
OpenEMR 5.0.2.1 - Remote Code Execution
Affected: 5.0.2.1
CVE-2025-32967
5.4
0%
May 23
OpenEMR doesn't log password administration properly
Affected: before 7.0.3.4
CVE-2025-31121
5.4
17%
Apr 1
OpenEMR allows XSS in Patient Image feature
Affected: before 7.0.3.1
CVE-2025-30161
5.4
11%
Mar 31
OpenEMR Stored XSS in OpenEMR Bronchitis Form
Affected: before 7.0.3
CVE-2023-2945
5.4
0%
May 27
Missing Authorization in openemr/openemr
Affected: before 7.0.1
CVE-2023-2944
5.4
0%
May 27
Improper Access Control in openemr/openemr
Affected: before 7.0.1
CVE-2023-22972
5.4
0%
Feb 22
A Reflected Cross-site scripting (XSS) vulnerability in interface/forms/eye_mag/php/eye_mag_functions.php in OpenEMR < 7.0.0 allows remote authenticated users to inject arbitrary…
Affected: before 7.0.0
CVE-2022-2824
5.4
1%
Aug 15
Authorization Bypass Through User-Controlled Key in openemr/openemr
Affected: before 7.0.0.1
CVE-2022-2734
5.4
1%
Aug 9
Improper Restriction of Rendered UI Layers or Frames in openemr/openemr
Affected: before 7.0.0.1
CVE-2022-2729
5.4
1%
Aug 9
Cross-site Scripting (XSS) - DOM in openemr/openemr
Affected: before 7.0.0.1
CVE-2022-2494
5.4
1%
Jul 22
Cross-site Scripting (XSS) - Stored in openemr/openemr
Affected: before 7.0.0
CVE-2022-1458
5.4
1%
Apr 25
Stored XSS Leads To Session Hijacking in openemr/openemr
Affected: before 6.1.0.1
CVE-2022-1179
5.4
77%
Mar 30
Non-Privilege User Can Created New Rule and Lead to Stored Cross Site Scripting in openemr/openemr
Affected: before 6.0.0.4
CVE-2022-1181
5.4
51%
Mar 30
Stored Cross Site Scripting in openemr/openemr
Affected: before 6.0.0.2
CVE-2022-1178
5.4
52%
Mar 30
Stored Cross Site Scripting in openemr/openemr
Affected: before 6.0.0.4
CVE-2022-24643
5.4
1%
Mar 25
A stored cross-site scripting (XSS) issue was discovered in the OpenEMR Hospital Information Management System version 6.0.0
Affected: 6.0.0
CVE-2021-25921
5.4
91%
Mar 22
In OpenEMR, versions 2.7.3-rc1 to 6.0.0 are vulnerable to Stored Cross-Site-Scripting (XSS) due to user input not being validated properly in the `Allergies` section
Affected: 2.7.3 through 6.0.0
CVE-2018-1000219
5.4
1%
Aug 20
OpenEMR version v5_0_1_4 contains a Cross Site Scripting (XSS) vulnerability in The 'scan' parameter in line #41 of interface/fax/fax_view.php that can result in The vulnerability…
Affected: 5.0.1.4
CVE-2018-1000218
5.4
1%
Aug 20
OpenEMR version v5_0_1_4 contains a Cross Site Scripting (XSS) vulnerability in The 'file' parameter in line #43 of interface/fax/fax_view.php that can result in The vulnerability…
Affected: 5.0.1.4
CVE-2017-1000240
5.4
1%
Nov 17
The application OpenEMR is affected by multiple reflected & stored Cross-Site Scripting (XSS) vulnerabilities affecting version 5.0.0 and prior versions
Affected: through 5.0.0
CVE-2018-17180
5.3
2%
May 17
An issue was discovered in OpenEMR before 5.0.1 Patch 7
Affected: before 5.0.1.7
CVE-2025-68277
5.0
0%
Feb 25
OpenEMR allows links sent via Secure Messaging to be opened in OpenEMR and Portal
Affected: before 7.0.4
CVE-2026-33913
4.9
0%
Mar 25
OpenEMR: XInclude Injection in CCDA Import Allows Reading Arbitrary Server Files
Affected: before 8.0.0.3
CVE-2026-25743
4.8
0%
Feb 25
OpenEMR has Stored XSS in Questionnaire answers
Affected: before 8.0.0
CVE-2024-0875
4.8
0%
Nov 15
Stored XSS in openemr/openemr
Affected: 7.0.1
CVE-2023-2947
4.8
90%
May 27
Cross-site Scripting (XSS) - Stored in openemr/openemr
Affected: before 7.0.1
Page 2 of 3 · 115 total
123