CVE records

Every CVE as the CVE Program publishes it, refreshed every ten minutes, with NVD's analysis, CISA's known-exploited status and a healthcare tag. Subscribers get the CVEs that match their own systems on My program, by email as they are published. Where the data comes from: sources.

Updated under an hour ago ()

What this means for you

This week: 5,463 CVEs published, 357 critical, and 7 newly confirmed exploited. Add your stack to see whether any of them hit you.

Published in the last 7 days
5,463
Show in the list
Critical, last 7 days
357
Show in the list
Healthcare-tagged, last 7 days
4
Show in the list
Known exploited (CISA KEV)
1,747
Show in the list

Showing CVEs that name the product librehealth:librehealth_ehr. Show all products

22 CVEs, showing 1 to 22
CVESeverityTitlePublished
CVE-2018-1000650
Healthcare
High 8.8LibreHealthIO lh-ehr version REL-2.0.0 contains a SQL Injection vulnerability in Show Groups Popup SQL query functions that can result in Ability to perform malicious database queries.
Assigned by mitre
Aug 20, 2018
CVE-2018-1000649
Healthcare
High 8.8LibreHealthIO lh-ehr version REL-2.0.0 contains a Authenticated Unrestricted File Write in letter.php (2) vulnerability in Patient file letter functions that can result in Write files with malicious…
Assigned by mitre
Aug 20, 2018
CVE-2018-1000648
Healthcare
High 8.8LibreHealthIO lh-ehr version REL-2.0.0 contains a Authenticated Unrestricted File Write vulnerability in Patient file letter functions that can result in Write files with malicious content and may le…
Assigned by mitre
Aug 20, 2018
CVE-2018-1000647
Healthcare
High 7.1LibreHealthIO lh-ehr version REL-2.0.0 contains a Authenticated Unrestricted File Deletion vulnerability in Import template that can result in Denial of service.
Assigned by mitre
Aug 20, 2018
CVE-2018-1000646
Healthcare
High 8.8LibreHealthIO LH-EHR version REL-2.0.0 contains an Authenticated Unrestricted File Write vulnerability in Import template that can result in write files with malicious content and may lead to remote…
Assigned by mitre
Aug 20, 2018
CVE-2018-1000645
Healthcare
Medium 6.5LibreHealthIO lh-ehr version <REL-2.0.0 contains an Authenticated Local File Disclosure vulnerability in Importing of templates allows local file disclosure that can result in Disclosure of sensitive…
Assigned by mitre
Aug 20, 2018
CVE-2018-1000839
Healthcare
High 8.8LH-EHR version REL-2_0_0 contains a Arbitrary File Upload vulnerability in Profile picture upload that can result in Remote Code Execution.
Assigned by mitre
Dec 20, 2018
CVE-2020-11439
Healthcare
High 8.8LibreHealth EMR v2.0.0 is affected by a Local File Inclusion issue allowing arbitrary PHP to be included and executed within the EMR application.
Assigned by mitre
Jul 15, 2020
CVE-2020-11437
Healthcare
Medium 4.3LibreHealth EMR v2.0.0 is affected by SQL injection allowing low-privilege authenticated users to enumerate the database.
Assigned by mitre
Jul 15, 2020
CVE-2020-11436
Healthcare
Critical 9.0LibreHealth EMR v2.0.0 is vulnerable to XSS that results in the ability to force arbitrary actions on behalf of other users including administrators.
Assigned by mitre
Jul 15, 2020
CVE-2020-11438
Healthcare
High 8.8LibreHealth EMR v2.0.0 is affected by systemic CSRF.
Assigned by mitre
Jul 15, 2020
CVE-2020-23829
Healthcare
High 8.8interface/new/new_comprehensive_save.php in LibreHealth EHR 2.0.0 suffers from an authenticated file upload vulnerability, allowing remote attackers to achieve remote code execution (RCE) on the host…
Assigned by mitre
Sep 1, 2020
CVE-2022-29940
Healthcare
Medium 5.4In LibreHealth EHR 2.0.0, lack of sanitization of the GET parameters formseq and formid in interface\orders\find_order_popup.php leads to multiple cross-site scripting (XSS) vulnerabilities.
Assigned by mitre
May 5, 2022
CVE-2022-29939
Healthcare
Medium 5.4In LibreHealth EHR 2.0.0, lack of sanitization of the GET parameters debug and InsId in interface\billing\sl_eob_process.php leads to multiple cross-site scripting (XSS) vulnerabilities.
Assigned by mitre
May 5, 2022
CVE-2022-29938
Healthcare
High 8.8In LibreHealth EHR 2.0.0, lack of sanitization of the GET parameter payment_id in interface\billing\new_payment.php via interface\billing\payment_master.inc.php leads to SQL injection.
Assigned by mitre
May 5, 2022
CVE-2022-31493
Healthcare
Medium 6.1LibreHealth EHR Base 2.0.0 allows gacl/admin/acl_admin.php acl_id XSS.
Assigned by mitre
Jun 6, 2022
CVE-2022-31492
Healthcare
Medium 6.1Cross Site scripting (XSS) vulnerability inLibreHealth EHR Base 2.0.0 via interface/usergroup/usergroup_admin_add.php Username.
Assigned by mitre
Jun 6, 2022
CVE-2022-31498
Healthcare
Medium 6.1LibreHealth EHR Base 2.0.0 allows interface/orders/patient_match_dialog.php key XSS.
Assigned by mitre
Jun 6, 2022
CVE-2022-31494
Healthcare
Medium 6.1LibreHealth EHR Base 2.0.0 allows gacl/admin/acl_admin.php action XSS.
Assigned by mitre
Jun 6, 2022
CVE-2022-31495
Healthcare
Medium 6.1LibreHealth EHR Base 2.0.0 allows gacl/admin/acl_admin.php return_page XSS.
Assigned by mitre
Jun 7, 2022
CVE-2022-31497
Healthcare
Medium 6.1LibreHealth EHR Base 2.0.0 allows interface/main/finder/finder_navigation.php patient XSS.
Assigned by mitre
Jun 8, 2022
CVE-2022-31496
Healthcare
High 8.8LibreHealth EHR Base 2.0.0 allows incorrect interface/super/manage_site_files.php access.
Assigned by mitre
Jun 8, 2022

CVSS is the assigning CNA's score where it gives one, otherwise NVD's. The healthcare tag is a documented heuristic (a list of clinical and health IT vendors, and clinical terms in the description), not a classification. The CVE record is authoritative.

Your cookie choices
We use essential cookies to run this site, and, only with your consent, an advertising cookie from Google to measure whether our ads lead to sign-ups and subscriptions. See our for details.