Vulnerabilities > Open EMR > Openemr > 4.1.1
DATE | CVE | VULNERABILITY TITLE | RISK |
---|---|---|---|
2017-06-02 | CVE-2017-9380 | Unrestricted Upload of File with Dangerous Type vulnerability in Open-Emr Openemr OpenEMR 5.0.0 and prior allows low-privilege users to upload files of dangerous types which can result in arbitrary code execution within the context of the vulnerable application. | 6.5 |
2015-07-05 | CVE-2015-4453 | Improper Authentication vulnerability in Open-Emr Openemr interface/globals.php in OpenEMR 2.x, 3.x, and 4.x before 4.2.0 patch 2 allows remote attackers to bypass authentication and obtain sensitive information via an ignoreAuth=1 value to certain scripts, as demonstrated by (1) interface/fax/fax_dispatch_newpid.php and (2) interface/billing/sl_eob_search.php. | 5.0 |
2013-08-09 | CVE-2013-4620 | Cross-Site Scripting vulnerability in Open-Emr Openemr 4.1.1 Cross-site scripting (XSS) vulnerability in interface/main/onotes/office_comments_full.php in OpenEMR 4.1.1 allows remote attackers to inject arbitrary web script or HTML via the note parameter. | 4.3 |
2013-08-09 | CVE-2013-4619 | SQL Injection vulnerability in Open-Emr Openemr 4.1.1 Multiple SQL injection vulnerabilities in OpenEMR 4.1.1 allow remote authenticated users to execute arbitrary SQL commands via the (1) start or (2) end parameter to interface/reports/custom_report_range.php, or the (3) form_newid parameter to custom/chart_tracker.php. | 6.5 |
2012-09-09 | CVE-2011-5161 | File-Upload vulnerability in Open-Emr Openemr 4.0.0/4.1.0/4.1.1 Unrestricted file upload vulnerability in the patient photograph functionality in OpenEMR 4 allows remote attackers to execute arbitrary PHP code by uploading a file with an executable extension followed by a safe extension, then accessing it via a direct request to the patient directory under documents/. network open-emr | 6.8 |
2012-09-09 | CVE-2011-5160 | Cross-Site Scripting vulnerability in Open-Emr Openemr 4.0.0/4.1.0/4.1.1 Cross-site scripting (XSS) vulnerability in setup.php in OpenEMR 4 allows remote attackers to inject arbitrary web script or HTML via the site parameter. | 4.3 |