OpenEMR Arbitrary File Write leading to Remote Code Execution

OpenEMR has an Unauthenticated MedEx Token Disclosure

An issue in OpenEMR 7.0.2 allows a remote attacker to escalate privileges viaa crafted POST request using the noteid parameter

OpenEMR 8.2.0 Remote Code Execution via CategoryTree eval() Injection

OpenEMR has Remote Code Execution in backup functionality

OpenEMR has Stored XSS in Graphical Pain Map legend via unescaped annotation text

OpenEMR Before 8.5.0 SQL Injection via form_icd_codes[]

OpenEMR Missing Authorization on Claim File Download Endpoint

OpenEMR has SQL Injection in CAMOS Form

OpenEMR has a SQL Injection Vulnerability in patient selection

OpenEMR Vulnerable to Authenticated Blind Boolean-Based SQL Injection in new_search_popup.php

SQL Injection Vulnerability in ajax graphs library (OpenEMR)

OpenEMR has SQL Injection Vulnerability

OpenEMR has SQL Injection in Immunization Search/Report

OpenEMR has Broken Access Control in Procedures Configuration

OpenEMR Vulnerable to Broken Access Control in Profile Edit Endpoint

OpenEMR: Stored XSS in prescription CSS/HTML print view via patient demographics

OpenEMR has stored XSS in portal_payment.php via Unescaped table_args

OpenEMR 8.2.0 OAuth2 Password Grant Authentication Bypass via SMART Configuration

OpenEMR 8.2.0 OAuth2 Dynamic Client Registration Unauthorized FHIR Access

OpenEMR Missing Authorization in Procedure Order AJAX Deletion Handler

OpenEMR: zhAclCheck Ignores Explicit ACL Denies

OpenEMR has arbitrary image file read via PDF generator

OpenEMR: Inverted ACL Condition in CDR ControllerRouter Allows Any Authenticated User to Modify/Delete Clinical Rules and Plans

OpenEMR's payments gateway_api_key secret rendered into client JS code

OpenEMR's Document and Insurance REST Endpoints Skip ACL

OpenEMR Has Disabled SSL Certificate Verification in HTTP Client

OpenEMR has Out-of-Band Server-Side Request Forgery (OOB SSRF)

OpemEMR Vulnerable to Stored XSS Attack in the Additional Address Section of Patient Demographics

OpenEMR Stored XSS via Patient Name Field in Procedure Orders

OpenEMR has Session Timeout Bypass via skip_timeout_reset

OpenEMR Out-of-Band Server-Side Request Forgery (OOB SSRF) Vulnerability

OpenEMR Has Directory Traversal in Load Code feature

OpenEMR Authenticated SQL Injection via backup.php Import Feature

OpenEMR has SQL Injection in PostCalendar Category Delete

OpenEMR's Portal Payment Endpoint Trusts User-Controlled pid

OpenEMR Missing Authorization Checks in DICOM Viewer State API

OpenEMR Path Traversal Arbitrary Directory Deletion via standard_tables_manage.php

OpenEMR has a Privilege Escalation that Allows a Low-Level User to View Admin-Only Data

OpenEMR has IDOR in Portal Payment Page that Allows Cross-Patient Record Access

OpenEMR has Authorization Bypass in Dated Reminders Log

OpenEMR Vulnerable to Path Traversal When Zipping DICOM Folders

OpenEMR: POST /api/.../vital Accepts Attacker-Supplied id and Overwrites Arbitrary Vitals

OpenEMR's Message Update Ignores Patient id

OpenEMR: Therapy Group Sensitivity ACL No Longer Enforced

OpenEMR Vulnerable to Arbitrary File Exfiltration via Fax Endpoint

OpenEMR's Eye Exam View Trusts form_id Without Verifying Patient/Encounter Ownership

OpenEMR's Printable LBF Endpoint Leaks Arbitrary Patient Forms

OpenEMR Patient Picture Context Allows Arbitrary Patient Photo Retrieval

OpenEMR Messages "Show All" Not Restricted to Admins