OP
Product
OpenEMR
221
CVEs
0
On KEV
9.9
Max CVSS
0
New 30D
Severity mix
Critical 15High 82Medium 115Low 2
Watch
Add OpenEMR to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2021-25919 | 4.8 | Mar 22 | In OpenEMR, versions 5.0.2 to 6.0.0 are vulnerable to Stored Cross-Site-Scripting (XSS) due to user input not being validated properly Affected: 5.0.2 through 6.0.0 |
| CVE-2021-25918 | 4.8 | Mar 22 | In OpenEMR, versions 5.0.2 to 6.0.0 are vulnerable to Stored Cross-Site-Scripting (XSS) due to user input not being validated properly and rendered in the TOTP Authentication… Affected: 5.0.2 through 6.0.0 |
| CVE-2021-25917 | 4.8 | Mar 22 | In OpenEMR, versions 5.0.2 to 6.0.0 are vulnerable to Stored Cross-Site-Scripting (XSS) due to user input not being validated properly and rendered in the U2F USB Device… Affected: 5.0.2 through 6.0.0 |
| CVE-2025-30149 | 4.6 | Mar 31 | OpenEMR Reflected XSS in AJAX Script Affected: before 7.0.3 |
| CVE-2026-25135 | 4.5 | Feb 25 | OpenEMR's location resource for Group.$export operation returns entire patient/user population contact information Affected: before 8.0.0 |
| CVE-2026-32119 | 4.4 | Mar 19 | OpenEMR has Stored DOM XSS via SearchHighlight text-node reconstruction on Custom Report page Affected: before 8.0.0.2 |
| CVE-2026-33934 | 4.3 | Mar 25 | OpenEMR's Missing Authorization in show-signature.php Allows Portal Patients to Read Staff Signatures Affected: before 8.0.0.3 |
| CVE-2026-32122 | 4.3 | Mar 11 | OpenEMR: Missing Authorization on Claim File Tracker UI and AJAX Endpoint (V2) Affected: before 8.0.0.1 |
| CVE-2023-2674 | 4.3 | May 12 | Improper Access Control in openemr/openemr Affected: before 7.0.1 |
| CVE-2022-4505 | 4.3 | Dec 15 | Authorization Bypass Through User-Controlled Key in openemr/openemr Affected: before 7.0.0.2 |
| CVE-2022-1177 | 4.3 | Mar 30 | Accounting User Can Download Patient Reports in openemr in openemr/openemr Affected: before 6.1.0 |
| CVE-2022-25041 | 4.3 | Mar 23 | OpenEMR v6.0.0 was discovered to contain an incorrect access control issue Affected: 6.0.0 |
| CVE-2024-26476 | 3.5 | Feb 28 | An issue in open-emr before v.7.0.2 allows a remote attacker to escalate privileges via a crafted script to the formid parameter in the ereq_form.php component Affected: before 7.0.2 |
| CVE-2022-1180 | 3.5 | Mar 30 | Reflected Cross Site Scripting in openemr/openemr Affected: before 6.0.0.4 |
| CVE-2015-4453 | – | Jul 5 | interface/globals.php in OpenEMR 2.x, 3.x, and 4.x before 4.2.0 patch 2 allows remote attackers to bypass authentication and obtain sensitive information via an ignoreAuth=1 value… Affected: 2.8.3; 2.9.0; 3.0.1; 3.1.0; 3.2.0; 4.0.0; +4 more |
| CVE-2014-5462 | – | Dec 8 | Multiple SQL injection vulnerabilities in OpenEMR 4.1.2 (Patch 7) and earlier allow remote authenticated users to execute arbitrary SQL commands via the (1) layout_id parameter to… Affected: through 4.1.2 |
| CVE-2013-4620 | – | Aug 9 | Cross-site scripting (XSS) vulnerability in interface/main/onotes/office_comments_full.php in OpenEMR 4.1.1 allows remote attackers to inject arbitrary web script or HTML via the… Affected: 4.1.1 |
| CVE-2013-4619 | – | Aug 9 | Multiple SQL injection vulnerabilities in OpenEMR 4.1.1 allow remote authenticated users to execute arbitrary SQL commands via the (1) start or (2) end parameter to… Affected: 4.1.1 |
| CVE-2012-2115 | – | Sep 9 | SQL injection vulnerability in interface/login/validateUser.php in OpenEMR 4.1.0 and possibly earlier allows remote attackers to execute arbitrary SQL commands via the u parameter Affected: through 4.1.0; 3.1.0; 3.2.0; 4.0.0 |
| CVE-2011-5161 | – | Sep 9 | Unrestricted file upload vulnerability in the patient photograph functionality in OpenEMR 4 allows remote attackers to execute arbitrary PHP code by uploading a file with an… Affected: 4.0.0; 4.1.0; 4.1.1 |
| CVE-2011-5160 | – | Sep 9 | Cross-site scripting (XSS) vulnerability in setup.php in OpenEMR 4 allows remote attackers to inject arbitrary web script or HTML via the site parameter Affected: 4.0.0; 4.1.0; 4.1.1 |