Skip to content
OpenAdvisories

Vendor

Open-Emr

275 known vulnerabilities.

Products

openemr 238 openemr/openemr 37
All Critical High Medium Low Exploited only Public exploit

275 results · Feed

  • High 8.6
    CVE-2026-126454

    OpenEMR before 8.5.0 lacks rate limiting or lockout on TOTP submission, allowing attackers with a valid password to bru…

    Open-Emr openemr
  • Medium 5.1
    CVE-2026-126456

    OpenEMR before 8.5.0 contains a stored cross-site scripting vulnerability in the Fee Sheet notecodes field, which is es…

    Open-Emr openemr
  • High 8.6
    CVE-2026-126455

    OpenEMR before 8.5.0 contains multiple missing authorization and SQL injection defects across report, portal, transacti…

    Open-Emr openemr
  • High 7.1
    CVE-2026-126457

    OpenEMR before 8.5.0 contains a missing authorization vulnerability in InstallerController that allows any authenticate…

    Open-Emr openemr
  • High 7.1
    CVE-2026-126460

    OpenEMR before 8.5.0 contains a persistent SQL injection vulnerability in SLEOB::slInvoiceNumber(), where the CLP01 cla…

    Open-Emr openemr
  • High 8.7
    CVE-2026-126458

    OpenEMR before 8.5.0 contains a missing authorization vulnerability in authorizations_full.php that allows any authenti…

    Open-Emr openemr
  • High 7.1
    CVE-2026-126461

    OpenEMR before 8.5.0 contains a missing authorization vulnerability in library/ajax/user_settings.php that lets any aut…

    Open-Emr openemr
  • High 7.1
    CVE-2026-126463

    OpenEMR before 8.5.0 contains multiple sql injection vulnerabilities that allow authenticated users to inject payloads …

    Open-Emr openemr
  • Medium 5.1
    CVE-2026-126462

    OpenEMR before 8.5.0 contains a stored cross-site scripting vulnerability that allows authenticated users with Eye Exam…

    Open-Emr openemr
  • Medium 5.3
    CVE-2026-126464

    OpenEMR before 8.5.0 contains a server-side request forgery vulnerability in PatientPortalPDFDocumentCreator::createPdf…

    Open-Emr openemr
  • High 8.7
    CVE-2026-126466

    OpenEMR before 8.5.0 contains a missing authorization vulnerability that allows any authenticated user to create patien…

    Open-Emr openemr
  • High 7.1
    CVE-2026-126465

    OpenEMR before 8.5.0 contains an SQL injection vulnerability in the patient portal api/onsiteactivityviews endpoint tha…

    Open-Emr openemr
  • High 7.1
    CVE-2026-126467

    OpenEMR before 8.5.0 contains a mass assignment vulnerability in ObservationController::processEnhancedFormSave() that …

    Open-Emr openemr
  • High 8.7
    CVE-2026-126469

    OpenEMR before 8.5.0 contains a missing authorization vulnerability in several custom/ scripts that rely only on sessio…

    Open-Emr openemr
  • High 8.7
    CVE-2026-126468

    OpenEMR before 8.5.0 contains a missing authorization vulnerability that allows any authenticated low-privilege user to…

    Open-Emr openemr
  • High 8.7
    CVE-2026-126470

    OpenEMR before 8.5.0 contains an insecure direct object reference vulnerability in the Carecoordination module that all…

    Open-Emr openemr
  • High 8.7
    CVE-2026-126472

    OpenEMR before 8.5.0 contains a missing authorization vulnerability in ccdaservice/ccda_gateway.php that allows any aut…

    Open-Emr openemr
  • High 7.1
    CVE-2026-126471

    OpenEMR before 8.5.0 contains a missing authorization vulnerability in print_referral.php and trend_form.php that allow…

    Open-Emr openemr
  • Critical 9.3
    CVE-2026-126473

    OpenEMR before 8.4.0 contains OAuth scope canonicalization and containment flaws that allow unauthenticated attackers t…

    Open-Emr openemr
  • Medium 5.1
    CVE-2026-126475

    OpenEMR before 8.5.0 contains a reflected cross-site scripting vulnerability that allows authenticated attackers to exe…

    Open-Emr openemr
  • Medium 5.1
    CVE-2026-126474

    OpenEMR before 8.5.0 contains a reflected cross-site scripting vulnerability in the ACL module that allows attackers to…

    Open-Emr openemr
  • Medium 5.1
    CVE-2026-126476

    OpenEMR before 8.5.0 contains a reflected cross-site scripting vulnerability in the Application module's auto-suggest e…

    Open-Emr openemr
  • High 7.2
    CVE-2026-126478

    OpenEMR before 8.5.0 contains an SQL injection vulnerability in the Syndromic Surveillance report because the form_icd_…

    Open-Emr openemr
  • Medium 4.6
    CVE-2026-126477

    OpenEMR before 8.5.0 contains a stored cross-site scripting vulnerability in the Eye Exam (eye_mag) module that allows …

    Open-Emr openemr
  • High 7.2
    CVE-2026-126479

    OpenEMR before 8.5.0 contains a missing authorization vulnerability in five Module Manager InstallerController actions …

    Open-Emr openemr
  • High 8.6
    CVE-2026-126480

    OpenEMR before 8.5.0 contains an sql injection vulnerability in CcrTable::insertApprovedData() that allows authenticate…

    Open-Emr openemr
  • High 8.7
    CVE-2026-126482

    OpenEMR before 8.5.0 contains an SQL injection vulnerability in SLEOB::slInvoiceNumber() in src/Billing/SLEOB.php, whic…

    Open-Emr openemr
  • High 7.2
    CVE-2026-126481

    OpenEMR before 8.5.0 contains a path traversal vulnerability in era_payments.php and sl_eob_search.php that allows auth…

    Open-Emr openemr
  • High 7.1
    CVE-2026-126483

    OpenEMR before 8.5.0 contains an SQL injection vulnerability that allows authenticated report users to manipulate queri…

    Open-Emr openemr
  • Medium 5.3
    CVE-2026-126485

    OpenEMR before 8.5.0 contains a cross-site request forgery vulnerability in ObservationController::deleteAction that al…

    Open-Emr openemr
  • Medium 5.1
    CVE-2026-126484

    OpenEMR before 8.5.0 contains a stored cross-site scripting vulnerability in printed_fee_sheet.php that allows authenti…

    Open-Emr openemr
  • High 7.2
    CVE-2026-126486

    OpenEMR before 8.5.0 contains a missing authorization vulnerability in portal/import_template.php, where several portal…

    Open-Emr openemr
  • High 8.7
    CVE-2026-126487

    OpenEMR before 8.5.0 contains an authorization bypass vulnerability that allows authenticated users to override system-…

    Open-Emr openemr
  • High 8.6
    CVE-2026-126489

    OpenEMR before 8.5.0 contains a second-order SQL injection vulnerability in the IPPF contraceptive issue feature becaus…

    Open-Emr openemr
  • High 8.3
    CVE-2026-126488

    OpenEMR before 8.5.0 contains an SQL injection vulnerability in the patient portal OnsiteDocument.Query endpoint, where…

    Open-Emr openemr
  • High 8.3
    CVE-2026-126491

    OpenEMR before 8.5.0 contains a stored SQL injection vulnerability in getByPatientDemographics() where layout_options f…

    Open-Emr openemr
  • Low 2.3
    CVE-2026-126490

    OpenEMR before 8.5.0 contains active debug code in interface/fax/fax_view.php that executes passthru("groups") and disc…

    Open-Emr openemr
  • High 7.1
    CVE-2026-126492

    OpenEMR before 8.5.0 contains a second-order sql injection vulnerability that allows low-privileged authenticated users…

    Open-Emr openemr
  • Medium 4.8
    CVE-2026-126493

    OpenEMR before 8.5.0 contains a stored cross-site scripting vulnerability that allows low-privileged patient portal use…

    Open-Emr openemr
  • High 7.1
    CVE-2026-126494

    OpenEMR before 8.4.0 contains an improper authorization vulnerability in ScopeRepository::finalizeScopes() that allows …

    Open-Emr openemr