OpenEMR has SQL Injection in Patient API Sort Parameter

OpenEMR Portal Users Can Forge Provider Signatures

OpenEMR has FHIR Patient Compartment Bypass in CareTeam Resource

OpenEMR has Broken Access Control on Care Coordination Module

OpenEMR has Broken Access Control in Report/Clients/Message List CSV Export

OpenEMR has Broken Access Control that allows unauthorized access to EDI Logs

OpenEMR Arbitrary File Read Vulnerability

OpenEMR may expose Contents of Clinical Notes and Care Planto users who do not have Sensitivities=high privilege

OpenEMR has IDOR in Patient Notes Web UI allows unauthorized note access/modification

OpenEMR has IDOR in Fee Sheet Product Save

OpenEMR < 8.3.0 Reflected XSS via templateHtml Parameter in Patient Portal

Reflected XSS via Unescaped contextName Parameter in Custom Template Editor

OpenEMR has Open Redirect in Eye Exam Form

OpenEMR allows inconsistent escaping of translation function output

OpenEMR allows Reflected XSS in CAMOS new.php

OpenEMR Vulnerable to SQL Injection via Unsanitized Variables in MedEx Recall/Reminder Processing

OpenEMR < 8.3.0 Stored XSS via Patient Portal Template Import Handler

OpenEMR has Improper ACL On Import/Export Popup

OpenEMR has Stored XSS in CCDA Preview via Unsanitized linkHtml Attributes

OpenEMR Missing ACL Checks on Insurance Company API Routes

OpenEMR has reflected XSS in ajax_download.php via reportID parameter

OpenEMR vulnerable to reflected XSS in graphs.php via title parameter

OpenEMR has Stored XSS in patient encounter Eye Exam form $CHRONIC2 and $CHRONIC3

OpenEMR has Authorization Bypass in FaxSMS AppDispatch Constructor

OpenEMR Vulnerable to Stored XSS via Unescaped portal_login_username in Credential Print View

OpenEMR has Stored XSS in patient encounter Eye Exam form answers

OpenEMR: Stored XSS in Track Anything Graphs via Unescaped Dygraph Titles/Labels

OpenEMR: Dynamic Code Picker Renders Unescaped Descriptions (Stored XSS)

OpenEMR: Stored DOM XSS via `.html()` in Portal Signer Modal

OpenEMR has a Stored XSS in GAD-7 Form that Enables Session Hijacking and Privilege Escalation

OpenEMR has Stored XSS in ub04 helper

OpenEMR doesn't log password administration properly

OpenEMR allows XSS in Patient Image feature

OpenEMR Stored XSS in OpenEMR Bronchitis Form

OpenEMR allows links sent via Secure Messaging to be opened in OpenEMR and Portal

OpenEMR: XInclude Injection in CCDA Import Allows Reading Arbitrary Server Files

OpenEMR 8.2.0 Stored XSS via import_template.php Template Management

OpenEMR has Stored XSS in Questionnaire answers

Stored XSS in openemr/openemr

OpenEMR Reflected XSS in AJAX Script

OpenEMR's location resource for Group.$export operation returns entire patient/user population contact information

OpenEMR has Stored DOM XSS via SearchHighlight text-node reconstruction on Custom Report page

OpenEMR < 8.3.0 Path Traversal Information Disclosure via EDI Archive Restore

OpenEMR < 8.3.0 CSRF via DICOM Viewer web_path Parameter

OpenEMR's Missing Authorization in show-signature.php Allows Portal Patients to Read Staff Signatures

OpenEMR: Missing Authorization on Claim File Tracker UI and AJAX Endpoint (V2)

interface/fax/fax_dispatch.php in OpenEMR 4.1.0 allows remote authenticated users to execute arbitrary commands via shell metacharacters in the file parameter

Multiple directory traversal vulnerabilities in OpenEMR 4.1.0 allow remote authenticated users to read arbitrary files via a

Variable overwrite vulnerability in interface/globals.php in OpenEMR 2.8.2 and earlier allows remote attackers to overwrite arbitrary program variables and conduct other…

PHP remote file inclusion vulnerability in library/translation.inc.php in OpenEMR 2.8.1, with register_globals enabled, allows remote attackers to execute arbitrary PHP code via a…