OP
Product
OpenEMR
221
CVEs
0
On KEV
9.9
Max CVSS
0
New 30D
Severity mix
Critical 15High 82Medium 115Low 2
Watch
Add OpenEMR to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2023-2566 | 4.8 | May 8 | Cross-site Scripting (XSS) - Stored in openemr/openemr Affected: before 7.0.1 |
| CVE-2022-4733 | 4.8 | Dec 24 | Cross-site Scripting (XSS) - Stored in openemr/openemr Affected: before 7.0.0.2 |
| CVE-2021-32103 | 4.8 | May 7 | A Stored XSS vulnerability in interface/usergroup/usergroup_admin.php in OpenEMR before 5.0.2.1 allows a admin authenticated user to inject arbitrary web script or HTML via the… Affected: through 5.0.2.1 |
| CVE-2021-25919 | 4.8 | Mar 22 | In OpenEMR, versions 5.0.2 to 6.0.0 are vulnerable to Stored Cross-Site-Scripting (XSS) due to user input not being validated properly Affected: 5.0.2 through 6.0.0 |
| CVE-2021-25918 | 4.8 | Mar 22 | In OpenEMR, versions 5.0.2 to 6.0.0 are vulnerable to Stored Cross-Site-Scripting (XSS) due to user input not being validated properly and rendered in the TOTP Authentication… Affected: 5.0.2 through 6.0.0 |
| CVE-2021-25917 | 4.8 | Mar 22 | In OpenEMR, versions 5.0.2 to 6.0.0 are vulnerable to Stored Cross-Site-Scripting (XSS) due to user input not being validated properly and rendered in the U2F USB Device… Affected: 5.0.2 through 6.0.0 |
| CVE-2025-30149 | 4.6 | Mar 31 | OpenEMR Reflected XSS in AJAX Script Affected: before 7.0.3 |
| CVE-2026-25135 | 4.5 | Feb 25 | OpenEMR's location resource for Group.$export operation returns entire patient/user population contact information Affected: before 8.0.0 |
| CVE-2026-32119 | 4.4 | Mar 19 | OpenEMR has Stored DOM XSS via SearchHighlight text-node reconstruction on Custom Report page Affected: before 8.0.0.2 |
| CVE-2026-33934 | 4.3 | Mar 25 | OpenEMR's Missing Authorization in show-signature.php Allows Portal Patients to Read Staff Signatures Affected: before 8.0.0.3 |
| CVE-2026-32122 | 4.3 | Mar 11 | OpenEMR: Missing Authorization on Claim File Tracker UI and AJAX Endpoint (V2) Affected: before 8.0.0.1 |
| CVE-2023-2674 | 4.3 | May 12 | Improper Access Control in openemr/openemr Affected: before 7.0.1 |
| CVE-2022-4505 | 4.3 | Dec 15 | Authorization Bypass Through User-Controlled Key in openemr/openemr Affected: before 7.0.0.2 |
| CVE-2022-1177 | 4.3 | Mar 30 | Accounting User Can Download Patient Reports in openemr in openemr/openemr Affected: before 6.1.0 |
| CVE-2022-25041 | 4.3 | Mar 23 | OpenEMR v6.0.0 was discovered to contain an incorrect access control issue Affected: 6.0.0 |