OpenEMR Path Traversal Arbitrary Directory Deletion via standard_tables_manage.php

OpenEMR has a Privilege Escalation that Allows a Low-Level User to View Admin-Only Data

OpenEMR has IDOR in Portal Payment Page that Allows Cross-Patient Record Access

OpenEMR has Authorization Bypass in Dated Reminders Log

OpenEMR Vulnerable to Path Traversal When Zipping DICOM Folders

OpenEMR: POST /api/.../vital Accepts Attacker-Supplied id and Overwrites Arbitrary Vitals

OpenEMR's Message Update Ignores Patient id

OpenEMR: Therapy Group Sensitivity ACL No Longer Enforced

OpenEMR Vulnerable to Arbitrary File Exfiltration via Fax Endpoint

OpenEMR's Eye Exam View Trusts form_id Without Verifying Patient/Encounter Ownership

OpenEMR's Printable LBF Endpoint Leaks Arbitrary Patient Forms

OpenEMR Patient Picture Context Allows Arbitrary Patient Photo Retrieval

OpenEMR Messages "Show All" Not Restricted to Admins

OpenEMR has SQL Injection in Patient API Sort Parameter

OpenEMR Portal Users Can Forge Provider Signatures

OpenEMR has FHIR Patient Compartment Bypass in CareTeam Resource

OpenEMR has Broken Access Control on Care Coordination Module

OpenEMR has Broken Access Control in Report/Clients/Message List CSV Export

OpenEMR has Broken Access Control that allows unauthorized access to EDI Logs

OpenEMR Arbitrary File Read Vulnerability

OpenEMR may expose Contents of Clinical Notes and Care Planto users who do not have Sensitivities=high privilege

OpenEMR has IDOR in Patient Notes Web UI allows unauthorized note access/modification

OpenEMR has IDOR in Fee Sheet Product Save

OpenEMR < 8.3.0 Reflected XSS via templateHtml Parameter in Patient Portal

Reflected XSS via Unescaped contextName Parameter in Custom Template Editor

OpenEMR has Open Redirect in Eye Exam Form

OpenEMR allows inconsistent escaping of translation function output

OpenEMR allows Reflected XSS in CAMOS new.php

OpenEMR Vulnerable to SQL Injection via Unsanitized Variables in MedEx Recall/Reminder Processing

OpenEMR < 8.3.0 Stored XSS via Patient Portal Template Import Handler

OpenEMR has Improper ACL On Import/Export Popup

OpenEMR has Stored XSS in CCDA Preview via Unsanitized linkHtml Attributes

OpenEMR Missing ACL Checks on Insurance Company API Routes

OpenEMR has reflected XSS in ajax_download.php via reportID parameter

OpenEMR vulnerable to reflected XSS in graphs.php via title parameter

OpenEMR has Stored XSS in patient encounter Eye Exam form $CHRONIC2 and $CHRONIC3

OpenEMR has Authorization Bypass in FaxSMS AppDispatch Constructor

OpenEMR Vulnerable to Stored XSS via Unescaped portal_login_username in Credential Print View

OpenEMR has Stored XSS in patient encounter Eye Exam form answers

OpenEMR: Stored XSS in Track Anything Graphs via Unescaped Dygraph Titles/Labels

OpenEMR: Dynamic Code Picker Renders Unescaped Descriptions (Stored XSS)

OpenEMR: Stored DOM XSS via `.html()` in Portal Signer Modal

OpenEMR has a Stored XSS in GAD-7 Form that Enables Session Hijacking and Privilege Escalation

OpenEMR has Stored XSS in ub04 helper

OpenEMR doesn't log password administration properly

OpenEMR allows XSS in Patient Image feature

OpenEMR Stored XSS in OpenEMR Bronchitis Form

OpenEMR allows links sent via Secure Messaging to be opened in OpenEMR and Portal

OpenEMR: XInclude Injection in CCDA Import Allows Reading Arbitrary Server Files

OpenEMR 8.2.0 Stored XSS via import_template.php Template Management