Archive
13 November 2026
Vulnerabilities first published on this day (UTC), newest first.
337 results · Clear filters · Feed
-
Medium 6.3
wasi-http p2: outgoing content-length can be invalid or not match body
The wasmtime-wasi-http p2 implementation in Wasmtime before 36.0.20, 37.0.0 before 48.0.8, 49.0.0 before 49.0.5, and 50.0.0 before 50.0.1 can send conflicting content-length headers, or ones not matching the body, in outgoing requests. A guest that reuses a r…
-
Medium 4.8
Wasmtime before 36.0.20 Denial of Service via Borrowed Resource Transfer
Wasmtime before 36.0.20, 37.0.0 before 48.0.8, 49.0.0 before 49.0.5, and 50.0.0 before 50.0.1 allocates untracked host memory when a component receives a borrow of a resource it defines itself, bypassing the per-store handle limit. A malicious guest component…
-
Medium 5.3
wasip3 UDP `send` can deliver a datagram to an address only allowed for receiving
Wasmtime's wasmtime-wasi crate 48.0.0 before 48.0.8, 49.0.0 before 49.0.5, and 50.0.0 before 50.0.1 contains a time-of-check/time-of-use race in the wasip3 wasi:sockets udp-socket host implementation that lets guests bypass socket_addr_check send restrictions…
-
Medium 5.4
Frappe HRMS 16.0.0 before 16.50.0 Missing Authorization in HR Workflow Endpoints
Frappe HRMS 16.0.0 before 16.50.0 lacks authorization checks on certain HR workflow endpoints, letting authenticated users access records they are not permitted to view. Any logged-in user, including one with only the Employee role, can read candidate record …
-
Medium 5.3
Frappe HRMS 15.x before 15.64.1 and 16.x before 16.19.0 contains a missing authorization vulnerability in an endpoint t…
-
Medium 6.5
OpenEMR before 8.5.0 Missing Authorization via Patientvalidation Module
OpenEMR before 8.5.0 contains a missing authorization vulnerability in the Patient Validation module that allows any authenticated user to retrieve patient demographic records. Attackers can send direct requests with wildcard mf_lname or empty mf_ parameters …
-
Medium 6.9
OpenEMR before 8.5.0 contains a stored cross-site scripting vulnerability in interface/billing/sl_eob_invoice.php, whic…
-
Medium 6.0
OpenEMR before 8.5.0 contains an access control flaw in get_claim_file.php: with location=tmp, it serves any file in th…
-
Medium 5.4
OpenEMR before 8.5.0 Missing Authorization in E-Sign Form Submission
OpenEMR before 8.5.0 contains a missing authorization vulnerability in the esign_form_submit handler of library/ESign/Form/Controller.php that verifies only the caller's password, not access to the patient, encounter, or form type. Authenticated core users ca…
-
Medium 5.3
OpenEMR before 8.5.0 contains an uncontrolled resource consumption vulnerability that allows authenticated users with p…
-
Medium 5.9
OpenEMR before 8.5.0 Missing Authorization in FaxSMS utility.php Patient Creation
OpenEMR before 8.5.0 contains a missing authorization vulnerability in the FaxSMS module's utility.php that allows read-only demographics users to create patient charts. Attackers can submit the form_create request with chosen identity fields to create fictit…
-
Medium 5.3
OpenEMR before 8.5.0 contains a missing authorization vulnerability in library/ajax/lists_touch.php that allows restric…
-
Medium 4.3
OpenEMR before 8.5.0 Denial of Service via ZIP Upload Decompression
OpenEMR before 8.5.0 contains a denial of service vulnerability in four ZIP upload paths that read uncompressed entries into memory without size or ratio checks. Authenticated billing or Carecoordination users can upload highly compressed ZIP archives to exha…
-
Medium 4.6
OpenEMR before 8.5.0 contains a stored SQL injection vulnerability in which History layout field identifiers saved thro…
-
Medium 4.6
OpenEMR before 8.5.0 Idle Session Timeout Bypass via Eye Exam Form
OpenEMR before 8.5.0 contains a session expiration vulnerability that prevents automatic logoff because the Eye Exam form's read-only poll omits skip_timeout_reset. Attackers with physical access to an unattended workstation can use the still-active session t…
-
Medium 5.3
OpenEMR 5.0.2 before 8.5.0 contains a missing authentication vulnerability in mfa_registrations.php and mfa_u2f.php tha…
-
Medium 6.8
OpenEMR before 8.5.0 Second-Order SQL Injection via Carecoordination CCDA Mapper
OpenEMR before 8.5.0 contains a second-order sql injection vulnerability that allows authenticated Carecoordination users to store malicious C-CDA field identifiers through the savedata action. Attackers can inject SQL into the IN clause built by fetchFormVal…
-
Medium 5.9
OpenEMR before 8.5.0 Improper Authorization in Lab Order Transmission via list_reports.php
OpenEMR before 8.5.0 contains an improper authorization vulnerability in interface/orders/list_reports.php that allows read-only users to transmit lab orders because the patients/med check ignores write permission. Authenticated attackers can submit form_xmit…
-
Medium 6.0
OpenEMR before 8.5.0 contains an improper authorization vulnerability in interface/drugs/dispense_drug.php, which check…
-
Medium 5.4
OpenEMR before 8.5.0 Improper Authorization via order_manifest.php Lab-Order Flags
OpenEMR before 8.5.0 contains an improper authorization vulnerability in interface/orders/order_manifest.php, which checks patients/med without requiring write access or applying patient squad restrictions. Users with only patients/med view permission can req…
-
Medium 5.3
OpenEMR before 8.5.0 contains an improper authorization vulnerability in interface/patient_file/rules/patient_data.php …
-
Medium 5.9
OpenEMR before 8.5.0 Document ACL Bypass via Care Coordination Import
OpenEMR before 8.5.0 contains a missing authorization flaw in the Care Coordination CCDA and CCR import controllers, which move a document named by the document_id parameter into the import category without checking access to the source document. Authenticate…
-
Medium 5.3
OpenEMR before 8.5.0 Authorization Bypass via C-CDA Gateway ccda_gateway.php
OpenEMR before 8.5.0 contains a missing authorization vulnerability in ccdaservice/ccda_gateway.php that fails to enforce the patients/pat_rep permission, accepting any authenticated core session. Authenticated users without patient-report permission can requ…
-
Medium 6.0
OpenEMR before 8.5.0 contains an insecure direct object reference vulnerability in the CAMOS rx_print.php printer that …
-
Medium 5.4
PowerPress Podcasting plugin by Blubrry <= 11.18.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'width' and 'height' Shortcode Attributes
The PowerPress Podcasting plugin by Blubrry plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'width' parameter in all versions up to, and including, 11.18.0 due to insufficient input sanitization and output escaping. This makes it pos…
-
Medium 6.5
OpenEMR before 8.5.0 Missing Authorization via dynamic_finder_ajax.php Patient Finder
OpenEMR before 8.5.0 contains a missing authorization vulnerability in dynamic_finder_ajax.php that allows authenticated users without patients/demo permission to query patient demographics. Attackers can supply arbitrary patient_data columns via the sColumns…
-
Medium 5.9
OpenEMR before 8.5.0 Missing Authorization in Ensora eRx via eRx.php
OpenEMR before 8.5.0 contains a missing authorization vulnerability in the Ensora eRx integration that allows authenticated staff without patients/rx permission to access prescription data by directly requesting eRx.php. Attackers can expose selected patients…
-
Medium 6.4
The WPZOOM Addons for Elementor – Starter Templates & Widgets plugin for WordPress is vulnerable to Stored Cross-Site S…
-
Medium 5.3
OpenEMR before 8.5.0 contains a missing authorization vulnerability that allows any authenticated core user to retrieve…
-
Medium 5.3
Customer Reviews for WooCommerce <= 5.127.0 - Unauthenticated Sensitive Information Exposure in 'search' Parameter
The Customer Reviews for WooCommerce plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 5.127.0 via the 'search' parameter of the cr_show_more_all_reviews and cr_show_more_reviews AJAX actions. This is due t…
-
Medium 6.5
Easy Property Listings <= 3.5.28 - Authenticated (Contributor+) SQL Injection via 'post_type' Shortcode Attribute
The Easy Property Listings plugin for WordPress is vulnerable to generic SQL Injection via the 'post_type' parameter in all versions up to, and including, 3.5.28 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on…
-
Medium 5.3
OpenEMR before 8.5.0 contains a missing authorization vulnerability that allows any authenticated core user to modify a…
-
Medium 5.3
OpenEMR before 8.5.0 Missing Authorization via trusted-messages-ajax.php Direct Messaging
OpenEMR before 8.5.0 contains a missing authorization vulnerability in trusted-messages-ajax.php that allows any authenticated core user to send Direct messages without the patients/notes permission. Attackers with zero-ACL accounts can submit chosen recipien…
-
Medium 6.5
Quiz and Survey Master (QSM) <= 11.2.9 - Authenticated (Contributor+) SQL Injection via 'qpages' Parameter
The Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker plugin for WordPress is vulnerable to generic SQL Injection via the 'qpages' parameter in all versions up to, and including, 11.2.9 due to insufficient escaping on the user supplied parameter and la…
-
Medium 6.4
WPeMatico RSS Feed Fetcher <= 2.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'post_category' Parameter
The WPeMatico RSS Feed Fetcher plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'post_category' parameter in all versions up to, and including, 2.9.1 due to insufficient input sanitization and output escaping. This makes it possible f…
-
Medium 6.4
The Passster – Password Protect Pages and Content plugin for WordPress is vulnerable to Stored Cross-Site Scripting via…
-
Medium 6.4
Recipe Card Blocks Lite <= 3.7.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'steps' Block Attribute
The Recipe Card Blocks Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'steps[].text' parameter in all versions up to, and including, 3.7.0 due to insufficient input sanitization and output escaping. This makes it possible for a…
-
Medium 6.4
The Download Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'file[additional_preview…
-
Medium 4.3
OpenEMR before 8.5.0 Missing Authorization in Nation Notes Configuration Handlers
OpenEMR before 8.5.0 contains a missing authorization vulnerability that allows authenticated users lacking nationnotes/nn_configure to modify shared Nation Notes templates by calling mutation endpoints directly. Attackers can send requests to ajax_code.php o…
-
Medium 5.3
OpenEMR before 8.5.0 contains a stored cross-site scripting vulnerability that allows authenticated users to inject scr…