Vulnerabilities > Open EMR > Openemr > 2.8.2

DATE CVE VULNERABILITY TITLE RISK
2021-03-22 CVE-2021-25921 Cross-site Scripting vulnerability in Open-Emr Openemr
In OpenEMR, versions 2.7.3-rc1 to 6.0.0 are vulnerable to Stored Cross-Site-Scripting (XSS) due to user input not being validated properly in the `Allergies` section.
network
low complexity
open-emr CWE-79
5.4
2021-03-22 CVE-2021-25920 Improper Handling of Case Sensitivity vulnerability in Open-Emr Openemr
In OpenEMR, versions v2.7.2-rc1 to 6.0.0 are vulnerable to Improper Access Control when creating a new user, which leads to a malicious user able to read and send sensitive messages on behalf of the victim user.
network
low complexity
open-emr CWE-178
6.5
2021-02-15 CVE-2020-29143 SQL Injection vulnerability in Open-Emr Openemr
A SQL injection vulnerability in interface/reports/non_reported.php in OpenEMR before 5.0.2.5 allows a remote authenticated attacker to execute arbitrary SQL commands via the form_code parameter.
network
low complexity
open-emr CWE-89
7.2
2021-02-15 CVE-2020-29140 SQL Injection vulnerability in Open-Emr Openemr
A SQL injection vulnerability in interface/reports/immunization_report.php in OpenEMR before 5.0.2.5 allows a remote authenticated attacker to execute arbitrary SQL commands via the form_code parameter.
network
low complexity
open-emr CWE-89
7.2
2021-02-15 CVE-2020-29139 SQL Injection vulnerability in Open-Emr Openemr
A SQL injection vulnerability in interface/main/finder/patient_select.php from library/patient.inc in OpenEMR before 5.0.2.5 allows a remote authenticated attacker to execute arbitrary SQL commands via the searchFields parameter.
network
low complexity
open-emr CWE-89
7.2
2021-02-15 CVE-2020-29142 SQL Injection vulnerability in Open-Emr Openemr
A SQL injection vulnerability in interface/usergroup/usergroup_admin.php in OpenEMR before 5.0.2.5 allows a remote authenticated attacker to execute arbitrary SQL commands via the schedule_facility parameter when restrict_user_facility=on is in global settings.
network
low complexity
open-emr CWE-89
7.2
2019-10-05 CVE-2019-17197 SQL Injection vulnerability in Open-Emr Openemr
OpenEMR through 5.0.2 has SQL Injection in the Lifestyle demographic filter criteria in library/clinical_rules.php that affects library/patient.inc.
network
low complexity
open-emr CWE-89
critical
9.8
2019-10-04 CVE-2019-17179 Cross-site Scripting vulnerability in Open-Emr Openemr
4.1.0, 4.1.1, 4.1.2, 4.1.2.3, 4.1.2.6, 4.1.2.7, 4.2.0, 4.2.1, 4.2.2, 5.0.0, 5.0.0.5, 5.0.0.6, 5.0.1, 5.0.1.1, 5.0.1.2, 5.0.1.3, 5.0.1.4, 5.0.1.5, 5.0.1.6, 5.0.1.7, 5.0.2, fixed in version 5.0.2.1
network
low complexity
open-emr CWE-79
6.1
2019-08-20 CVE-2019-3968 OS Command Injection vulnerability in Open-Emr Openemr
In OpenEMR 5.0.1 and earlier, an authenticated attacker can execute arbitrary commands on the host system via the Scanned Forms interface when creating a new form.
network
low complexity
open-emr CWE-78
8.8
2019-08-20 CVE-2019-3967 Path Traversal vulnerability in Open-Emr Openemr
In OpenEMR 5.0.1 and earlier, the patient file download interface contains a directory traversal flaw that allows authenticated attackers to download arbitrary files from the host system.
network
low complexity
open-emr CWE-22
6.5