openemr at a glance
Show as table
| Month | Vulnerabilities | Critical |
|---|---|---|
| Nov 2026 | 140 | 6 |
| Oct 2026 | 1 | 0 |
| Sep 2026 | 0 | 0 |
| Aug 2026 | 10 | 1 |
| Jul 2026 | 0 | 0 |
| Jun 2026 | 1 | 0 |
| May 2026 | 1 | 0 |
| Apr 2026 | 0 | 0 |
| Mar 2026 | 44 | 3 |
| Feb 2026 | 27 | 2 |
| Jan 2026 | 3 | 0 |
| Dec 2025 | 0 | 0 |
| Nov 2025 | 0 | 0 |
| Oct 2025 | 0 | 0 |
| Sep 2025 | 0 | 0 |
| Aug 2025 | 1 | 0 |
| Jul 2025 | 0 | 0 |
| Jun 2025 | 0 | 0 |
| May 2025 | 3 | 0 |
| Apr 2025 | 1 | 0 |
| Mar 2025 | 5 | 0 |
| Feb 2025 | 0 | 0 |
| Jan 2025 | 0 | 0 |
| Dec 2024 | 0 | 0 |
238 results · Feed
-
High 8.6
OpenEMR before 8.3.0 contains an unsanitized deserialization vulnerability that allows authenticated attackers to contr…
-
High 7.1
OpenEMR before 8.5.0 contains a missing authorization vulnerability in the Patient Validation module that allows any au…
-
High 7.1
OpenEMR before 8.5.0 contains an improper authorization vulnerability in patient_tracker_status.php that allows low-pri…
-
Medium 6.9
OpenEMR before 8.5.0 contains a stored cross-site scripting vulnerability in interface/billing/sl_eob_invoice.php, whic…
-
Medium 6.0
OpenEMR before 8.5.0 contains an access control flaw in get_claim_file.php: with location=tmp, it serves any file in th…
-
Medium 5.3
OpenEMR before 8.5.0 contains a missing authorization vulnerability in the esign_form_submit handler of library/ESign/F…
-
Medium 5.3
OpenEMR before 8.5.0 contains an uncontrolled resource consumption vulnerability that allows authenticated users with p…
-
Medium 6.0
OpenEMR before 8.5.0 contains a missing authorization vulnerability in the FaxSMS module's utility.php that allows read…
-
Medium 5.3
OpenEMR before 8.5.0 contains a missing authorization vulnerability in library/ajax/lists_touch.php that allows restric…
-
Medium 4.6
OpenEMR before 8.5.0 contains a stored cross-site scripting vulnerability that allows users with admin/superbill write …
-
Medium 5.3
OpenEMR before 8.5.0 contains a denial of service vulnerability in four ZIP upload paths that read uncompressed entries…
-
Medium 4.6
OpenEMR before 8.5.0 contains a stored SQL injection vulnerability in which History layout field identifiers saved thro…
-
Medium 4.3
OpenEMR before 8.5.0 contains a session expiration vulnerability that prevents automatic logoff because the Eye Exam fo…
-
Medium 5.3
OpenEMR 5.0.2 before 8.5.0 contains a missing authentication vulnerability in mfa_registrations.php and mfa_u2f.php tha…
-
High 7.7
OpenEMR before 8.5.0 contains a remote code execution vulnerability that allows authenticated billing users to store at…
-
High 8.6
OpenEMR before 8.5.0 contains an sql injection vulnerability that allows any authenticated core user to inject SQL by s…
-
High 7.1
OpenEMR before 8.5.0 passes authenticated user-controlled HTML from the doc_lib.php content parameter to mPDF, which re…
-
High 7.6
OpenEMR before 8.5.0 contains a second-order sql injection vulnerability that allows authenticated Carecoordination use…
-
Medium 6.0
OpenEMR before 8.5.0 contains an improper authorization vulnerability in interface/orders/list_reports.php that allows …
-
High 8.6
OpenEMR before 8.5.0 contains a missing authorization vulnerability in interface/forms/procedure_order/common.php that …
-
Medium 6.0
OpenEMR before 8.5.0 contains an improper authorization vulnerability in interface/drugs/dispense_drug.php, which check…
-
Medium 5.3
OpenEMR before 8.5.0 contains an improper authorization vulnerability in interface/orders/order_manifest.php, which che…
-
High 7.1
OpenEMR before 8.5.0 contains an authorization bypass vulnerability in portal/lib/download_template.php that allows any…
-
High 8.7
OpenEMR before 8.5.0 contains an authorization bypass vulnerability that allows OAuth2 clients to use unregistered gran…
-
Medium 5.3
OpenEMR before 8.5.0 contains an improper authorization vulnerability in interface/patient_file/rules/patient_data.php …
-
Medium 6.0
OpenEMR before 8.5.0 contains a missing authorization flaw in the Care Coordination CCDA and CCR import controllers, wh…
-
Medium 6.0
OpenEMR before 8.5.0 contains a missing authorization vulnerability in ccdaservice/ccda_gateway.php that fails to enfor…
-
Medium 6.0
OpenEMR before 8.5.0 contains an insecure direct object reference vulnerability in the CAMOS rx_print.php printer that …
-
High 7.1
OpenEMR before 8.5.0 contains a missing authorization vulnerability in dynamic_finder_ajax.php that allows authenticate…
-
High 8.6
OpenEMR before 8.5.0 contains a missing authorization vulnerability in create_portallogin.php that allows low-privilege…
-
Medium 6.0
OpenEMR before 8.5.0 contains a missing authorization vulnerability in the Ensora eRx integration that allows authentic…
-
Medium 5.3
OpenEMR before 8.5.0 contains a missing authorization vulnerability that allows any authenticated core user to retrieve…
-
Medium 5.3
OpenEMR before 8.5.0 contains a missing authorization vulnerability that allows any authenticated core user to modify a…
-
Medium 6.0
OpenEMR before 8.5.0 contains a missing authorization vulnerability in trusted-messages-ajax.php that allows any authen…
-
High 7.1
OpenEMR before 8.5.0 contains a missing authorization vulnerability in immunizations.php, diagnosis_full.php, and billi…
-
Medium 5.3
OpenEMR before 8.5.0 contains a missing authorization vulnerability that allows authenticated users lacking nationnotes…
-
Medium 5.3
OpenEMR before 8.5.0 contains a stored cross-site scripting vulnerability that allows authenticated users to inject scr…
-
High 7.1
OpenEMR before 8.5.0 contains a missing authorization vulnerability in diagnosis_full.php that allows authenticated use…
-
High 8.5
OpenEMR before 8.5.0 contains a stored cross-site scripting vulnerability that allows portal patients to run JavaScript…
-
High 7.1
OpenEMR before 8.5.0 contains an inverted comparison in Document::has_expired() that causes the FHIR Binary download en…