405,446 results · Feed
-
Medium 6.5
OpenEMR before 8.4.0 Cross-Patient Payment Tampering via Rainforest Portal Payments
OpenEMR before 8.4.0 contains an improper authorization vulnerability in Rainforest patient portal payments that trusts browser-supplied patientId, encounter, and amount values instead of deriving them from the portal session. Authenticated portal patients ca…
-
Medium 6.5
OpenEMR before 8.4.0 Arbitrary File Read via REST Document Download
OpenEMR before 8.4.0 contains an arbitrary local file read vulnerability in REST document download, where the controller passes stored uploaded document bytes to Symfony's BinaryFileResponse as a filesystem path instead of returning them as content. Authentic…
-
Medium 6.5
OpenEMR before 8.3.0 Missing Authorization via addRecall in save.php
OpenEMR before 8.3.0 contains a missing authorization vulnerability in the addRecall action of /interface/main/messages/save.php that allows low-privileged authenticated users to modify arbitrary patients' recall data. Attackers can submit a crafted new_pid w…
-
Medium 6.5
OpenEMR before 8.3.0 IDOR via form_pid in portal/lib/paylib.php
OpenEMR before 8.3.0 contains an insecure direct object reference in portal/lib/paylib.php, which writes the request-supplied form_pid (or the patient_id_cc value in Sphere data) to onsite_portal_activity without checking it against the session patient. Authe…
-
High 8.8
OpenEMR before 8.3.0 Missing Authorization via delete_Recall in save.php
OpenEMR before 8.3.0 contains a missing authorization vulnerability that allows low-privileged authenticated users to delete arbitrary patient recall records via the delete_Recall action. Attackers can send POST requests to /interface/main/messages/save.php w…
-
High 7.1
OpenEMR before 8.3.0 IDOR via portal/lib/persist.php setting_patient
OpenEMR before 8.3.0 contains an insecure direct object reference vulnerability in portal/lib/persist.php that allows authenticated portal patients to modify other patients' settings by supplying an arbitrary setting_patient value. Attackers can insert or ove…
-
High 8.1
OpenEMR before 8.3.0 Missing Authorization via sl_eob_patient_note.php
OpenEMR before 8.3.0 contains a missing authorization vulnerability in interface/billing/sl_eob_patient_note.php that allows any authenticated user to read and modify patient billing notes. Attackers with low-privilege accounts can enumerate the patient_id pa…
-
High 7.1
OpenEMR before 8.3.0 Broken Object Authorization via SOAP Note Update API
OpenEMR before 8.3.0 contains a broken object-level authorization vulnerability in the SOAP note update API, which does not verify that the supplied SOAP note ID (sid) belongs to the supplied patient and encounter. Authenticated users with encounters/notes pe…
-
High 8.1
OpenEMR before 8.3.0 Missing Authorization and IDOR via sl_eob_invoice.php
OpenEMR before 8.3.0 contains a missing authorization vulnerability in interface/billing/sl_eob_invoice.php that allows any authenticated user to read and modify billing data for any encounter. Attackers can iterate the id parameter to read patient names and …
-
Critical 9.9
OpenEMR before 8.3.0 SQL Injection via Fee Sheet warehouse parameter
OpenEMR before 8.3.0 contains an SQL injection vulnerability in the Fee Sheet drug-inventory lookup (DrugSalesService::sellDrug) that interpolates the prod[N][warehouse] POST field into an ORDER BY clause. Low-privileged authenticated users can submit Fee She…
-
Medium 6.5
OpenEMR before 8.3.0 BOLA via portal_custom_report.php Exposes Patient Problem Lists
OpenEMR before 8.3.0 contains a broken object level authorization vulnerability in portal/report/portal_custom_report.php that allows authenticated portal patients to read other patients' problem list entries. Attackers can enumerate sequential IDs in issue_ …
-
High 7.1
OpenEMR before 8.3.0 SQL Injection via Patient Insurance and Employer REST API
OpenEMR before 8.3.0 contains an SQL injection vulnerability in the Standard REST API patient insurance and employer search, which concatenates query-string parameter names into SQL as column identifiers without escaping. Authenticated clients, including low-…
-
High 7.2
OpenEMR before 8.4.0 Unauthenticated SSRF via OAuth2 Client jwks_uri
OpenEMR before 8.4.0 contains a server-side request forgery vulnerability that allows unauthenticated attackers to make the server send HTTP requests by registering an OAuth2 client with an unvalidated jwks_uri. Attackers can trigger the fetch via the token i…
-
High 8.8
OpenEMR before 8.4.0 Remote Code Execution via ESign LFI and fax upload
OpenEMR before 8.4.0 contains a local file inclusion in the ESign router (library/ESign/Router.php), which passes the unsanitized module parameter into a require_once of '<module>/Controller.php', and the fax module's faxProcessUploads writes attacker-named f…
-
Medium 6.5
OpenEMR before 8.4.0 FHIR Patient Compartment Bypass via QuestionnaireResponse
OpenEMR before 8.4.0 contains an authorization bypass vulnerability that allows patient-scoped SMART tokens to read other patients' questionnaire responses because FhirQuestionnaireResponseService does not implement IPatientCompartmentResourceService. Attacke…
-
Medium 6.5
OpenEMR before 8.3.0 Patient Portal IDOR via Case-Sensitive Pid Parameter
OpenEMR before 8.3.0 contains an insecure direct object reference vulnerability in OnsiteDocumentController::Query() that allows authenticated portal patients to bypass the lowercase pid authorization guard by supplying a capitalised Pid parameter. Attackers …
-
High 8.7
OpenEMR before 8.3.0 Stored XSS via CAMOS Rx Print View
OpenEMR before 8.3.0 contains a stored cross-site scripting vulnerability that allows authenticated users with CAMOS access to inject HTML by saving malicious CAMOS content through ajax_save.php. Attackers can store a script payload that executes unencoded wh…
-
High 8.1
OpenEMR before 8.3.0 IDOR via DICOM library/ajax/upload.php Endpoint
OpenEMR before 8.3.0 contains a missing authorization vulnerability in library/ajax/upload.php that allows any authenticated user to read and overwrite document data by supplying an arbitrary doc_id. Low-privilege users can enumerate doc_id values with the fe…
-
High 8.1
OpenEMR before 8.3.0 Cross-Patient IDOR via Encounter Form Viewers and Save Handlers
OpenEMR before 8.3.0 contains an insecure direct object reference vulnerability in many encounter-form view and save endpoints that lack patient/encounter ownership checks. Authenticated clinical users can enumerate sequential form id values in requests such …
-
Medium 6.5
OpenEMR before 8.3.0 IDOR in Patient Portal PortalPatientController
OpenEMR before 8.3.0 contains an insecure direct object reference vulnerability in PortalPatientController::Read() that allows authenticated patients to read other patients' pending demographic change requests. Attackers can supply another patient's ID in the…
-
Medium 6.5
OpenEMR before 8.4.0 FHIR Patient Compartment Bypass via Person Endpoint
OpenEMR before 8.4.0 contains an authorization bypass vulnerability in the FHIR GET /fhir/Person/:uuid route that allows patient-portal users to read any staff member's demographics by bypassing compartment enforcement. Attackers holding a patient SMART token…
-
High 7.1
OpenEMR before 8.3.0 Missing Authorization and IDOR in Prior-Authorizations Module
OpenEMR before 8.3.0 contains missing authorization and insecure direct object reference vulnerabilities in the oe-module-prior-authorizations module that allow authenticated low-privilege users to access and modify other patients' records. Attackers can requ…
-
High 7.6
OpenEMR before 8.3.0 Path Traversal via sl_eob_process.php eraname
OpenEMR before 8.3.0 contains a path traversal vulnerability in interface/billing/sl_eob_process.php that allows authenticated users to write and read files by supplying unsanitized eraname values. Attackers without billing privileges can inject ../ sequences…
-
Medium 6.5
OpenEMR before 8.3.0 IDOR via Portal OnsiteDocument Pid_Equals Mass-Assignment
OpenEMR before 8.3.0 contains an insecure direct object reference vulnerability in OnsiteDocumentController::Query() that allows authenticated portal patients to read other patients' documents by overriding Pid_Equals criteria. Attackers can supply Pid_Equals…
-
Medium 5.4
OpenEMR before 8.3.0 Stored XSS via Eye Exam Document Notes
OpenEMR before 8.3.0 contains a stored cross-site scripting vulnerability in interface/forms/eye_mag/report.php that allows authenticated users to inject scripts by adding unescaped document notes. Attackers with document-note write access can store malicious…
-
High 7.1
OpenEMR before 8.3.0 IDOR in Portal Patient Settings via persist.php
OpenEMR before 8.3.0 contains an insecure direct object reference vulnerability in portal/lib/persist.php that allows authenticated portal patients to write settings for other patients. Attackers can modify the setting_patient parameter in a JSON POST request…
-
Medium 5.3
OpenEMR before 8.4.0 Authorization Bypass via checkUserHasAccessToPatient in SMART on FHIR
OpenEMR before 8.4.0 contains an authorization bypass vulnerability in its SMART on FHIR implementation because checkUserHasAccessToPatient() in BearerTokenAuthorizationStrategy.php unconditionally returns true. Authenticated users or malicious SMART apps can…
-
Critical 9.9CVE-2026-124450 Public exploit
OpenEMR before 8.3.0 Arbitrary File Read/Write via disposeDocument
OpenEMR before 8.3.0 contains a broken access control and path traversal vulnerability in the fax/sms module disposeDocument action via an unvalidated file_path parameter. Authenticated low-privilege users can read sqlconf.php to recover database credentials …
-
Medium 6.5
OpenEMR before 8.4.0 Missing Authorization via FHIR Media and QuestionnaireResponse Routes
OpenEMR before 8.4.0 contains a missing authorization vulnerability in FHIR Media/:uuid and QuestionnaireResponse read routes that skip ACL checks. Non-patient API tokens lacking OpenEMR ACLs can request resources by uuid, bypassing compartment filtering to r…
-
High 7.6
OpenEMR before 8.3.0 Stored XSS via CCDA/CCD Preview XSLT Attributes
OpenEMR before 8.3.0 contains a stored cross-site scripting vulnerability in the CCDA/CCD preview stylesheets, where cda.xsl copies event-handler attributes whose values evade a character denylist and ccd.xsl copies table-cell attributes unsanitized into prev…
-
High 8.1
OpenEMR before 8.3.0 IDOR via OnsitePortalActivityController Update Endpoint
OpenEMR before 8.3.0 contains an insecure direct object reference vulnerability in OnsitePortalActivityController::Update() that checks the request's patientId instead of the stored record's owner. Authenticated portal patients can send PUT requests to the on…
-
High 8.8
OpenEMR before 8.3.0 Arbitrary File Read and Write via FaxSMS disposeDocument
OpenEMR before 8.3.0 contains a path traversal vulnerability in the FaxSMS module's RCFaxClient and SignalWireClient disposeDocument functions that allows authenticated low-privilege users to read and overwrite arbitrary files via the unsanitized file_path pa…
-
Critical 9.8
OpenEMR 7.0.1 before 8.4.0 OneTimeAuth Token Replay and PIN Brute Force
OpenEMR from 7.0.1 before 8.4.0 contains a flaw in src/Common/Auth/OneTimeAuth.php that ignores the enforce_onetime_use and max_access_count flags, never revokes consumed service_auth tokens, and checks login_pin without rate limiting or strict comparison. At…
-
High 7.1
OpenEMR before 8.4.0 SQL Injection via OnsiteDocument Query API
OpenEMR before 8.4.0 contains a mass assignment vulnerability in the patient portal OnsiteDocument query API that lets request parameters set bitwise criteria filters whose values are placed unquoted into the SQL WHERE clause. Authenticated patient portal use…
-
Medium 4.3
Frappe before 16.35.0 Broken Access Control in File List/Report Queries
Frappe Framework before 15.121.1 and 16.x before 16.35.0 contains a broken access control vulnerability in File list and report queries that fails to restrict private file records to authorized users. Authenticated users can query File list or report views to…
-
Medium 6.5
AzuraCast before 0.24.0 SSRF Filter Bypass via Webhook Connector Redirects
AzuraCast before 0.24.0 contains a server-side request forgery vulnerability that allows users with station WebHooks permission to bypass the UserUrlFilter SSRF guard through HTTP redirects. Attackers can configure Mastodon, Telegram, GroupMe, or RadioReg web…
-
High 8.8
Kyverno before 1.19.2 Authorization Bypass via Variable Generate Target Kind
Kyverno before 1.19.2 contains an authorization bypass vulnerability that allows namespaced tenants to generate any resource kind in any namespace by templating the generate rule's kind and namespace with variables. Attackers can create a Policy and trigger C…
-
Critical 9.9
Kyverno 1.19.1 Privilege Escalation via apiCall Namespace Clamp Bypass
Kyverno from 1.19.1 before 1.19.2 contains an authorization bypass vulnerability in the apiCall namespace clamp that allows namespace tenants to issue cross-namespace and cluster-scoped API requests by appending malformed percent-escapes to urlPath. Attackers…
-
High 7.5
Scriban before 7.5.3 Denial of Service via Uncatchable StackOverflowException
Scriban and Scriban.Signed before 7.5.3 contain uncontrolled recursion flaws in which postfix member, indexer, and call chains bypass ExpressionDepthLimit, array comparison lacks depth and cycle checks, and object.eval bypasses RecursiveLimit. Attackers who c…
-
High 7.4
Scriban before 7.5.2 Delegate Target Exposure via array.map Member Access
Scriban before 7.5.2 contains an information disclosure and object manipulation vulnerability that allows template authors to access .NET internals of function values through reflection member accessors. Attackers can use array.map to read Target, Method, or …