OpenEMR Before 8.5.0 SQL Injection via form_icd_codes[]

OpenEMR Missing Authorization on Claim File Download Endpoint

OpenEMR has SQL Injection in CAMOS Form

OpenEMR has a SQL Injection Vulnerability in patient selection

OpenEMR Vulnerable to Authenticated Blind Boolean-Based SQL Injection in new_search_popup.php

SQL Injection Vulnerability in ajax graphs library (OpenEMR)

OpenEMR has SQL Injection Vulnerability

OpenEMR has SQL Injection in Immunization Search/Report

OpenEMR has Broken Access Control in Procedures Configuration

OpenEMR Vulnerable to Broken Access Control in Profile Edit Endpoint

OpenEMR: Stored XSS in prescription CSS/HTML print view via patient demographics

OpenEMR has stored XSS in portal_payment.php via Unescaped table_args

OpenEMR 8.2.0 OAuth2 Password Grant Authentication Bypass via SMART Configuration

OpenEMR 8.2.0 OAuth2 Dynamic Client Registration Unauthorized FHIR Access

OpenEMR Missing Authorization in Procedure Order AJAX Deletion Handler

OpenEMR: zhAclCheck Ignores Explicit ACL Denies

OpenEMR has arbitrary image file read via PDF generator

OpenEMR: Inverted ACL Condition in CDR ControllerRouter Allows Any Authenticated User to Modify/Delete Clinical Rules and Plans

OpenEMR's payments gateway_api_key secret rendered into client JS code

OpenEMR's Document and Insurance REST Endpoints Skip ACL

OpenEMR Has Disabled SSL Certificate Verification in HTTP Client

OpenEMR has Out-of-Band Server-Side Request Forgery (OOB SSRF)

OpemEMR Vulnerable to Stored XSS Attack in the Additional Address Section of Patient Demographics

OpenEMR Stored XSS via Patient Name Field in Procedure Orders

OpenEMR has Session Timeout Bypass via skip_timeout_reset

OpenEMR Out-of-Band Server-Side Request Forgery (OOB SSRF) Vulnerability

OpenEMR Has Directory Traversal in Load Code feature

OpenEMR Authenticated SQL Injection via backup.php Import Feature

OpenEMR has SQL Injection in PostCalendar Category Delete

OpenEMR's Portal Payment Endpoint Trusts User-Controlled pid

OpenEMR Missing Authorization Checks in DICOM Viewer State API