Archive
November 2026
Vulnerabilities first published in this month (UTC), newest first.
3,147 results · Clear filters · Feed
-
Medium 4.3
OpenEMR before 8.5.0 Denial of Service via ZIP Upload Decompression
OpenEMR before 8.5.0 contains a denial of service vulnerability in four ZIP upload paths that read uncompressed entries into memory without size or ratio checks. Authenticated billing or Carecoordination users can upload highly compressed ZIP archives to exha…
-
Medium 4.6
OpenEMR before 8.5.0 contains a stored SQL injection vulnerability in which History layout field identifiers saved thro…
-
Medium 4.6
OpenEMR before 8.5.0 Idle Session Timeout Bypass via Eye Exam Form
OpenEMR before 8.5.0 contains a session expiration vulnerability that prevents automatic logoff because the Eye Exam form's read-only poll omits skip_timeout_reset. Attackers with physical access to an unattended workstation can use the still-active session t…
-
Medium 5.3
OpenEMR 5.0.2 before 8.5.0 contains a missing authentication vulnerability in mfa_registrations.php and mfa_u2f.php tha…
-
Medium 6.8
OpenEMR before 8.5.0 Second-Order SQL Injection via Carecoordination CCDA Mapper
OpenEMR before 8.5.0 contains a second-order sql injection vulnerability that allows authenticated Carecoordination users to store malicious C-CDA field identifiers through the savedata action. Attackers can inject SQL into the IN clause built by fetchFormVal…
-
Medium 5.9
OpenEMR before 8.5.0 Improper Authorization in Lab Order Transmission via list_reports.php
OpenEMR before 8.5.0 contains an improper authorization vulnerability in interface/orders/list_reports.php that allows read-only users to transmit lab orders because the patients/med check ignores write permission. Authenticated attackers can submit form_xmit…
-
Medium 6.0
OpenEMR before 8.5.0 contains an improper authorization vulnerability in interface/drugs/dispense_drug.php, which check…
-
Medium 5.4
OpenEMR before 8.5.0 Improper Authorization via order_manifest.php Lab-Order Flags
OpenEMR before 8.5.0 contains an improper authorization vulnerability in interface/orders/order_manifest.php, which checks patients/med without requiring write access or applying patient squad restrictions. Users with only patients/med view permission can req…
-
Medium 5.3
OpenEMR before 8.5.0 contains an improper authorization vulnerability in interface/patient_file/rules/patient_data.php …
-
Medium 5.9
OpenEMR before 8.5.0 Document ACL Bypass via Care Coordination Import
OpenEMR before 8.5.0 contains a missing authorization flaw in the Care Coordination CCDA and CCR import controllers, which move a document named by the document_id parameter into the import category without checking access to the source document. Authenticate…
-
Medium 5.3
OpenEMR before 8.5.0 Authorization Bypass via C-CDA Gateway ccda_gateway.php
OpenEMR before 8.5.0 contains a missing authorization vulnerability in ccdaservice/ccda_gateway.php that fails to enforce the patients/pat_rep permission, accepting any authenticated core session. Authenticated users without patient-report permission can requ…
-
Medium 6.0
OpenEMR before 8.5.0 contains an insecure direct object reference vulnerability in the CAMOS rx_print.php printer that …
-
Medium 5.4
PowerPress Podcasting plugin by Blubrry <= 11.18.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'width' and 'height' Shortcode Attributes
The PowerPress Podcasting plugin by Blubrry plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'width' parameter in all versions up to, and including, 11.18.0 due to insufficient input sanitization and output escaping. This makes it pos…
-
Medium 6.5
OpenEMR before 8.5.0 Missing Authorization via dynamic_finder_ajax.php Patient Finder
OpenEMR before 8.5.0 contains a missing authorization vulnerability in dynamic_finder_ajax.php that allows authenticated users without patients/demo permission to query patient demographics. Attackers can supply arbitrary patient_data columns via the sColumns…
-
Medium 5.9
OpenEMR before 8.5.0 Missing Authorization in Ensora eRx via eRx.php
OpenEMR before 8.5.0 contains a missing authorization vulnerability in the Ensora eRx integration that allows authenticated staff without patients/rx permission to access prescription data by directly requesting eRx.php. Attackers can expose selected patients…
-
Medium 6.4
The WPZOOM Addons for Elementor – Starter Templates & Widgets plugin for WordPress is vulnerable to Stored Cross-Site S…
-
Medium 5.3
OpenEMR before 8.5.0 contains a missing authorization vulnerability that allows any authenticated core user to retrieve…
-
Medium 5.3
Customer Reviews for WooCommerce <= 5.127.0 - Unauthenticated Sensitive Information Exposure in 'search' Parameter
The Customer Reviews for WooCommerce plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 5.127.0 via the 'search' parameter of the cr_show_more_all_reviews and cr_show_more_reviews AJAX actions. This is due t…
-
Medium 6.5
Easy Property Listings <= 3.5.28 - Authenticated (Contributor+) SQL Injection via 'post_type' Shortcode Attribute
The Easy Property Listings plugin for WordPress is vulnerable to generic SQL Injection via the 'post_type' parameter in all versions up to, and including, 3.5.28 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on…
-
Medium 5.3
OpenEMR before 8.5.0 contains a missing authorization vulnerability that allows any authenticated core user to modify a…
-
Medium 5.3
OpenEMR before 8.5.0 Missing Authorization via trusted-messages-ajax.php Direct Messaging
OpenEMR before 8.5.0 contains a missing authorization vulnerability in trusted-messages-ajax.php that allows any authenticated core user to send Direct messages without the patients/notes permission. Attackers with zero-ACL accounts can submit chosen recipien…
-
Medium 6.5
Quiz and Survey Master (QSM) <= 11.2.9 - Authenticated (Contributor+) SQL Injection via 'qpages' Parameter
The Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker plugin for WordPress is vulnerable to generic SQL Injection via the 'qpages' parameter in all versions up to, and including, 11.2.9 due to insufficient escaping on the user supplied parameter and la…
-
Medium 6.4
WPeMatico RSS Feed Fetcher <= 2.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'post_category' Parameter
The WPeMatico RSS Feed Fetcher plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'post_category' parameter in all versions up to, and including, 2.9.1 due to insufficient input sanitization and output escaping. This makes it possible f…
-
Medium 6.4
The Passster – Password Protect Pages and Content plugin for WordPress is vulnerable to Stored Cross-Site Scripting via…
-
Medium 6.4
Recipe Card Blocks Lite <= 3.7.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'steps' Block Attribute
The Recipe Card Blocks Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'steps[].text' parameter in all versions up to, and including, 3.7.0 due to insufficient input sanitization and output escaping. This makes it possible for a…
-
Medium 6.4
The Download Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'file[additional_preview…
-
Medium 4.3
OpenEMR before 8.5.0 Missing Authorization in Nation Notes Configuration Handlers
OpenEMR before 8.5.0 contains a missing authorization vulnerability that allows authenticated users lacking nationnotes/nn_configure to modify shared Nation Notes templates by calling mutation endpoints directly. Attackers can send requests to ajax_code.php o…
-
Medium 5.3
OpenEMR before 8.5.0 contains a stored cross-site scripting vulnerability that allows authenticated users to inject scr…
-
Medium 4.9
The WPMR Google Feed Manager for WooCommerce – Sell on Google Merchant Center & Shopping plugin for WordPress is vulner…
-
Medium 6.5
The Newsletters plugin for WordPress is vulnerable to blind SQL Injection via the 'user_email' parameter in all version…
-
Medium 4.4
The CF7 Apps – Honeypot, Database, Redirection, Webhook, and Addons for Contact Form 7 plugin for WordPress is vulnerab…
-
Medium 5.4
OpenEMR before 8.5.0 Stored XSS via Fee Sheet notecodes field
OpenEMR before 8.5.0 contains a stored cross-site scripting vulnerability in the Fee Sheet notecodes field, which is escaped with the wrong context. Attackers with clinician access can inject a payload that breaks out of the single-quoted value attribute and …
-
Medium 6.5
OpenEMR before 8.5.0 Missing Authorization via user_settings.php Global Override
OpenEMR before 8.5.0 contains a missing authorization vulnerability in library/ajax/user_settings.php that lets any authenticated user persist arbitrary global configuration overrides. Attackers can POST global:-prefixed keys to re-point external service host…
-
Medium 5.1
OpenEMR before 8.5.0 contains a stored cross-site scripting vulnerability that allows authenticated users with Eye Exam…
-
Medium 4.3
OpenEMR before 8.5.0 SSRF via Patient Portal PDF Generation
OpenEMR before 8.5.0 contains a server-side request forgery vulnerability in PatientPortalPDFDocumentCreator::createPdfObject() that allows authenticated patients to make the server issue HTTP GET requests. Attackers can submit img src, inline style url(), or…
-
Medium 6.5
OpenEMR before 8.5.0 SQL Injection via OnsiteActivityView _BitwiseAnd Criteria
OpenEMR before 8.5.0 contains an SQL injection vulnerability in the patient portal api/onsiteactivityviews endpoint that allows any authenticated staff user to inject SQL through unquoted Id_BitwiseAnd Criteria values. Attackers can close the bitwise parenthe…
-
Medium 5.1
OpenEMR before 8.5.0 contains a reflected cross-site scripting vulnerability that allows authenticated attackers to exe…
-
Medium 5.1
OpenEMR before 8.5.0 contains a reflected cross-site scripting vulnerability in the ACL module that allows attackers to…
-
Medium 6.1
OpenEMR before 8.5.0 Reflected XSS via auto-suggest searchMode parameter
OpenEMR before 8.5.0 contains a reflected cross-site scripting vulnerability in the Application module's auto-suggest endpoint, which echoes the searchMode POST parameter unencoded into a single-quoted onClick attribute. Attackers can induce an authenticated …
-
Medium 4.8
OpenEMR before 8.5.0 Stored XSS via Eye Exam Defaults in eye_base.php
OpenEMR before 8.5.0 contains a stored cross-site scripting vulnerability in the Eye Exam (eye_mag) module that allows administrators to inject JavaScript through unencoded Eye_defaults list option titles. Attackers can store a crafted title via edit_list.php…