CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 1CVE-2017-6394
https://notcve.org/view.php?id=CVE-2017-6394
02 Mar 2017 — Multiple Cross-Site Scripting (XSS) issues were discovered in OpenEMR 5.0.0 and 5.0.1-dev. The vulnerabilities exist due to insufficient filtration of user-supplied data passed to the "openemr-master/gacl/admin/object_search.php" URL (section_value; src_form). An attacker could execute arbitrary HTML and script code in a browser in the context of the vulnerable website. Se ha descubierto un problema en OpenEMR 5.0.1-dev. La vulnerabilidad existe debido a filtración insuficiente de datos suministrados por el... • http://www.securityfocus.com/bid/96539 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.5EPSS: 21%CPEs: 10EXPL: 0CVE-2015-4453 – OpenEMR 4.2.0 Authentication Bypass
https://notcve.org/view.php?id=CVE-2015-4453
19 Jun 2015 — interface/globals.php in OpenEMR 2.x, 3.x, and 4.x before 4.2.0 patch 2 allows remote attackers to bypass authentication and obtain sensitive information via an ignoreAuth=1 value to certain scripts, as demonstrated by (1) interface/fax/fax_dispatch_newpid.php and (2) interface/billing/sl_eob_search.php. interface/globals.php en OpenEMR 2.x, 3.x y 4.x en versiones anteriores a 4.2.0 patch 2 permite a atacantes remotos eludir la autenticación y obtener información sensible a través de un valor ignoreAuth=1 a... • http://jvn.jp/en/jp/JVN22677713/index.html • CWE-287: Improper Authentication •
CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 5CVE-2014-5462 – OpenEMR 4.1.2 - Multiple SQL Injections
https://notcve.org/view.php?id=CVE-2014-5462
05 Dec 2014 — Multiple SQL injection vulnerabilities in OpenEMR 4.1.2 (Patch 7) and earlier allow remote authenticated users to execute arbitrary SQL commands via the (1) layout_id parameter to interface/super/edit_layout.php; (2) form_patient_id, (3) form_drug_name, or (4) form_lot_number parameter to interface/reports/prescriptions_report.php; (5) payment_id parameter to interface/billing/edit_payment.php; (6) id parameter to interface/forms_admin/forms_admin.php; (7) form_pid or (8) form_encounter parameter to interfa... • https://packetstorm.news/files/id/129403 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 1CVE-2013-4619 – OpenEMR 4.1.1 patch-12 Cross Site Scripting / SQL Injection
https://notcve.org/view.php?id=CVE-2013-4619
14 Jul 2013 — Multiple SQL injection vulnerabilities in OpenEMR 4.1.1 allow remote authenticated users to execute arbitrary SQL commands via the (1) start or (2) end parameter to interface/reports/custom_report_range.php, or the (3) form_newid parameter to custom/chart_tracker.php. Múltiples vulnerabilidades de inyección SQL en OpenEMR v4.1.1 permite a usuarios autenticados remotamente ejecutar comandos SQL arbitrarios a través de los parámetros (1) “start” o (2) “end” interface/reports/custom_report_range.php, o en el p... • https://packetstorm.news/files/id/122391 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 2CVE-2013-4620 – OpenEMR 4.1 - 'note' HTML Injection
https://notcve.org/view.php?id=CVE-2013-4620
14 Jul 2013 — Cross-site scripting (XSS) vulnerability in interface/main/onotes/office_comments_full.php in OpenEMR 4.1.1 allows remote attackers to inject arbitrary web script or HTML via the note parameter. Vulnerabilidad Cross-site scripting (XSS) en interface/main/onotes/office_comments_full.php en OpenEMR v4.1.1 , permite a atacantes remotos ejecutar secuencias de comandos web o HTML arbitrarias a través del parámetro “note”. OpenEMR versions 4.1.1 patch-12 and below suffer from cross site scripting and remote SQL i... • https://packetstorm.news/files/id/122391 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 9.8EPSS: 0%CPEs: 4EXPL: 3CVE-2012-2115 – OpenEMR 4 - Multiple Vulnerabilities
https://notcve.org/view.php?id=CVE-2012-2115
09 Sep 2012 — SQL injection vulnerability in interface/login/validateUser.php in OpenEMR 4.1.0 and possibly earlier allows remote attackers to execute arbitrary SQL commands via the u parameter. Vulnerabilidad de inyección SQL en interface/login/validateUser.php en OpenEMR v4.1.0 y posiblemente versiones anteriores, permiten a atacantes remotos ejecutar comandos SQL de su elección a través del parámetro u. • https://www.exploit-db.com/exploits/18274 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 9.8EPSS: 0%CPEs: 3EXPL: 2CVE-2011-5161 – OpenEMR 4 - Multiple Vulnerabilities
https://notcve.org/view.php?id=CVE-2011-5161
09 Sep 2012 — Unrestricted file upload vulnerability in the patient photograph functionality in OpenEMR 4 allows remote attackers to execute arbitrary PHP code by uploading a file with an executable extension followed by a safe extension, then accessing it via a direct request to the patient directory under documents/. Vulnerabilidad de subida de ficheros sin restricciones en la funcionalidad fotografía de paciente en OpenEMR v4, permite a atacantes remotos ejecutar código PHP de su elección mediante la carga de un archi... • https://www.exploit-db.com/exploits/18274 •
CVSS: 6.1EPSS: 0%CPEs: 3EXPL: 3CVE-2011-5160 – OpenEMR 4 - Multiple Vulnerabilities
https://notcve.org/view.php?id=CVE-2011-5160
09 Sep 2012 — Cross-site scripting (XSS) vulnerability in setup.php in OpenEMR 4 allows remote attackers to inject arbitrary web script or HTML via the site parameter. Vulnerabilidad de ejecución de secuencias de comandos en sitios cruzados (XSS) en OpenEMR v4 permite a atacantes remotos inyectar secuencias de comandos web o HTML a través del parámetro site. • https://www.exploit-db.com/exploits/18274 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 8.8EPSS: 1%CPEs: 1EXPL: 3CVE-2012-0992 – OpenEMR 4.1 - '/Interface/fax/fax_dispatch.php?File' 'exec()' Call Arbitrary Shell Command Execution
https://notcve.org/view.php?id=CVE-2012-0992
07 Feb 2012 — interface/fax/fax_dispatch.php in OpenEMR 4.1.0 allows remote authenticated users to execute arbitrary commands via shell metacharacters in the file parameter. interface/fax/fax_dispatch.php en OpenEMR v4.1.0, permite a usuarios autenticados remotamente ejecutar comandos de su elección a través de metacaracteres de linea de comandos en el parámetro file. • https://www.exploit-db.com/exploits/36651 • CWE-20: Improper Input Validation •
CVSS: 6.5EPSS: 4%CPEs: 1EXPL: 6CVE-2012-0991 – OpenEMR 4.1 - '/contrib/acog/print_form.php?formname' Traversal Local File Inclusion
https://notcve.org/view.php?id=CVE-2012-0991
07 Feb 2012 — Multiple directory traversal vulnerabilities in OpenEMR 4.1.0 allow remote authenticated users to read arbitrary files via a .. (dot dot) in the formname parameter to (1) contrib/acog/print_form.php; or (2) load_form.php, (3) view_form.php, or (4) trend_form.php in interface/patient_file/encounter. Múltiples vulnerabilidades de salto de directorio en OpenEMR v4.1.0, permite a usuarios autenticados remotamente leer archivos de su elección a través de un .. (punto punto) en el parámetro formname en (1) contri... • https://www.exploit-db.com/exploits/36650 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •