open-emr openemr 6.0.0 vulnerabilities and exploits

(subscribe to this query)

9.8

CVSSv3

Multiple SQL injection vulnerabilities exist in phpGACL 3.3.7. A specially crafted HTTP request can lead to a SQL injection. An attacker can send an HTTP request to trigger this vulnerability.

Open-emr Openemr 5.0.2 Phpgacl Project Phpgacl 3.3.7 Open-emr Openemr 6.0.0

4.3

CVSSv3

OpenEMR v6.0.0 exists to contain an incorrect access control issue.

Open-emr Openemr 6.0.0

5.4

CVSSv3

A stored cross-site scripting (XSS) issue exists in the OpenEMR Hospital Information Management System version 6.0.0.

Open-emr Openemr 6.0.0

6.5

CVSSv3

An authenticated SQL injection issue in the calendar search function of OpenEMR 6.0.0 before patch 3 allows an malicious user to read data from all tables of the database via the parameter provider_id, as demonstrated by the /interface/main/calendar/index.php?module=PostCalendar&...

Open-emr Openemr 6.0.0

6.5

CVSSv3

OpenEMR 6.0.0 has a pnotes_print.php?noteid= Insecure Direct Object Reference vulnerability via which an attacker can read the messages of all users.

Open-emr Openemr 6.0.0

4 Github repositories

8.1

CVSSv3

An Insecure Direct Object Reference (IDOR) vulnerability in OpenEMR 6.0.0 allows any authenticated malicious user to access and modify unauthorized areas via a crafted POST request to /modules/zend_modules/public/Installer/register.

Open-emr Openemr 6.0.0

6.5

CVSSv3

In OpenEMR, versions v2.7.2-rc1 to 6.0.0 are vulnerable to Improper Access Control when creating a new user, which leads to a malicious user able to read and send sensitive messages on behalf of the victim user.

Open-emr Openemr

4.8

CVSSv3

In OpenEMR, versions 5.0.2 to 6.0.0 are vulnerable to Stored Cross-Site-Scripting (XSS) due to user input not being validated properly. A highly privileged attacker could inject arbitrary code into input fields when creating a new user.

Open-emr Openemr

6.1

CVSSv3

In OpenEMR, versions 4.2.0 to 6.0.0 are vulnerable to Reflected Cross-Site-Scripting (XSS) due to user input not being validated properly. An attacker could trick a user to click on a malicious url and execute malicious code.

Open-emr Openemr

5.4

CVSSv3

In OpenEMR, versions 2.7.3-rc1 to 6.0.0 are vulnerable to Stored Cross-Site-Scripting (XSS) due to user input not being validated properly in the `Allergies` section. An attacker could lure an admin to enter a malicious payload and by that initiate the exploit.

Open-emr Openemr

Get Started

1 2 NEXT »

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Twitter Reddit Linkedin Facebook