Export limit exceeded: 415780 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (415780 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-126421 | 1 Open-emr | 1 Openemr | 2026-11-13 | 4.3 Medium |
| OpenEMR before 8.5.0 contains an uncontrolled resource consumption vulnerability that allows authenticated users with patients/med access to exhaust PHP workers via an unbounded count parameter. Attackers can send print_labels requests to labs_ajax.php with huge counts, forcing mPDF page and barcode generation that makes OpenEMR unavailable. | ||||
| CVE-2026-126422 | 1 Open-emr | 1 Openemr | 2026-11-13 | 4.3 Medium |
| OpenEMR before 8.5.0 contains a missing authorization vulnerability in library/ajax/lists_touch.php that allows restricted authenticated users to mark another patient's clinical lists as reviewed. Attackers can submit arbitrary patient_id and type values to falsely record "None known" allergy, medication, or problem lists, misleading clinicians and skewing quality-measure calculations. | ||||
| CVE-2026-126423 | 1 Open-emr | 1 Openemr | 2026-11-13 | 4.3 Medium |
| OpenEMR before 8.5.0 contains a denial of service vulnerability in four ZIP upload paths that read uncompressed entries into memory without size or ratio checks. Authenticated billing or Carecoordination users can upload highly compressed ZIP archives to exhaust PHP memory and worker pools, making OpenEMR unavailable. | ||||
| CVE-2026-126424 | 1 Open-emr | 1 Openemr | 2026-11-13 | 3.5 Low |
| OpenEMR before 8.5.0 contains a stored cross-site scripting vulnerability that allows users with admin/superbill write permission to inject HTML into SNOMED code descriptions via superbill_custom_full.php. When a clinician selects the malicious code, the Functional and Cognitive Status form or fee-sheet forms assign it to innerHTML, executing JavaScript in the clinician's session to read patient data and perform actions. | ||||
| CVE-2026-126425 | 1 Open-emr | 1 Openemr | 2026-11-13 | 7.2 High |
| OpenEMR before 8.5.0 contains a stored SQL injection vulnerability in which History layout field identifiers saved through edit_layout.php, including HIS fields and LBF source-H fields, are placed unvalidated into an INSERT statement for patients without a history_data row. Users with admin/super and patients/med write access can trigger history_save.php or LBF saves to execute SQL functions like SLEEP, tying up database workers or accessing data beyond their privileges. | ||||
| CVE-2026-126426 | 1 Open-emr | 1 Openemr | 2026-11-13 | 4.3 Medium |
| OpenEMR 5.0.2 before 8.5.0 contains a missing authentication vulnerability in mfa_registrations.php and mfa_u2f.php that allows session hijackers to delete MFA factors or register U2F keys without password re-entry. Attackers holding a victim's authenticated session can remove all second factors or add their own U2F key, bypassing MFA at later logins with the password. | ||||
| CVE-2026-126427 | 1 Open-emr | 1 Openemr | 2026-11-13 | 4.6 Medium |
| OpenEMR before 8.5.0 contains a session expiration vulnerability that prevents automatic logoff because the Eye Exam form's read-only poll omits skip_timeout_reset. Attackers with physical access to an unattended workstation can use the still-active session to view patient health information, since update_READONLY() resets the idle timer every 15 seconds. | ||||
| CVE-2026-126428 | 1 Open-emr | 1 Openemr | 2026-11-13 | 7.5 High |
| OpenEMR before 8.5.0 contains a remote code execution vulnerability that allows authenticated billing users to store attacker-controlled PHP by uploading a malformed ERA file to era_payments.php. Attackers with a database-write primitive such as SQL injection can register a background_services row whose require_once loads the stored .edi file, executing PHP as the web-server user. | ||||
| CVE-2026-126429 | 1 Open-emr | 1 Openemr | 2026-11-13 | 6.5 Medium |
| OpenEMR before 8.5.0 passes authenticated user-controlled HTML from the doc_lib.php content parameter to mPDF, which resolves local files and nested SVG resources. Authenticated patients or core users can submit crafted CSS imports or php://filter SVG references to read arbitrary server files including credentials and OAuth keys. | ||||
| CVE-2026-126430 | 1 Open-emr | 1 Openemr | 2026-11-13 | 8.1 High |
| OpenEMR before 8.5.0 contains an sql injection vulnerability that allows any authenticated core user to inject SQL by supplying crafted patient_data field names to the CCR revandapprove controller. Attackers can embed scalar subqueries in the UPDATE patient_data SET clause to read staff password hashes and portal reset values, alter arbitrary patient demographics, and take over patient-portal accounts. | ||||
| CVE-2026-126431 | 1 Open-emr | 1 Openemr | 2026-11-13 | 6.8 Medium |
| OpenEMR before 8.5.0 contains a second-order sql injection vulnerability that allows authenticated Carecoordination users to store malicious C-CDA field identifiers through the savedata action. Attackers can inject SQL into the IN clause built by fetchFormValues() during C-CDA generation to extract password hashes, portal reset values, and patient records. | ||||
| CVE-2026-126432 | 1 Open-emr | 1 Openemr | 2026-11-13 | 5.9 Medium |
| OpenEMR before 8.5.0 contains an improper authorization vulnerability in interface/orders/list_reports.php that allows read-only users to transmit lab orders because the patients/med check ignores write permission. Authenticated attackers can submit form_xmit with arbitrary procedure order IDs to send HL7 orders containing SSNs, insurance, and diagnoses to laboratories and mark them transmitted. | ||||
| CVE-2026-126433 | 1 Open-emr | 1 Openemr | 2026-11-13 | 5.9 Medium |
| OpenEMR before 8.5.0 contains an improper authorization vulnerability in interface/drugs/dispense_drug.php, which checks only for admin/drugs view permission instead of write permission before dispensing medication. Authenticated users with read-only drug administration access can send GET requests with drug_id, quantity, fee, and encounter parameters to create false dispensing records and decrement inventory. | ||||
| CVE-2026-126434 | 1 Open-emr | 1 Openemr | 2026-11-13 | 8.1 High |
| OpenEMR before 8.5.0 contains a missing authorization vulnerability in interface/forms/procedure_order/common.php that allows authenticated accounts lacking patients/lab permission to read and modify other patients' procedure orders. Attackers can request a global order id to disclose clinical history, or select the target patient in their session and submit bn_save to falsify diagnoses, instructions, and order status. | ||||
| CVE-2026-126435 | 1 Open-emr | 1 Openemr | 2026-11-13 | 5.4 Medium |
| OpenEMR before 8.5.0 contains an improper authorization vulnerability in interface/orders/order_manifest.php, which checks patients/med without requiring write access or applying patient squad restrictions. Users with only patients/med view permission can request any order ID to read squad-restricted patient data and submit bn_save and form_omit parameters, without a CSRF token, to set do_not_send flags that suppress ordered lab procedures. | ||||
| CVE-2026-126436 | 1 Open-emr | 1 Openemr | 2026-11-13 | 7.5 High |
| OpenEMR before 8.5.0 contains an authorization bypass vulnerability that allows OAuth2 clients to use unregistered grant types because oauth_clients.grant_types is never enforced. Attackers can request tokens with grant_type=password to bypass the user consent screen, and disabled clients can redeem authorization codes using JWT client assertions. | ||||
| CVE-2026-126437 | 1 Open-emr | 1 Openemr | 2026-11-13 | 6.5 Medium |
| OpenEMR before 8.5.0 contains an authorization bypass vulnerability in portal/lib/download_template.php that allows any authenticated core user to render documents for arbitrary patients by setting isModule. Attackers can submit arbitrary pid and template_id values to disclose patient names, birth dates, chart IDs, addresses, allergies, medications, and problem lists despite ACL and squad restrictions. | ||||
| CVE-2026-126438 | 1 Open-emr | 1 Openemr | 2026-11-13 | 4.3 Medium |
| OpenEMR before 8.5.0 contains an improper authorization vulnerability in interface/patient_file/rules/patient_data.php that allows read-only patients/med users to modify clinical-rule records. Attackers can submit a global form_entryID row ID to overwrite completion date, state, and result, including records of patients outside their configured squad. | ||||
| CVE-2026-126439 | 1 Open-emr | 1 Openemr | 2026-11-13 | 5.3 Medium |
| OpenEMR before 8.5.0 contains a missing authorization vulnerability in ccdaservice/ccda_gateway.php that fails to enforce the patients/pat_rep permission, accepting any authenticated core session. Authenticated users without patient-report permission can request the report_ccd_view action to retrieve the selected patient's C-CDA clinical summary, including diagnoses, medications, laboratory results, and identifiers. | ||||
| CVE-2026-126440 | 1 Open-emr | 1 Openemr | 2026-11-13 | 5.9 Medium |
| OpenEMR before 8.5.0 contains a missing authorization flaw in the Care Coordination CCDA and CCR import controllers, which move a document named by the document_id parameter into the import category without checking access to the source document. Authenticated non-administrators with Care Coordination access can recategorize protected patient documents and then download them through normal ACL-checked retrieval. | ||||