InfoSec Signals™
Sign InStart Free

CVE records

Every CVE as the CVE Program publishes it, refreshed every ten minutes, with NVD's analysis, CISA's known-exploited status and a healthcare tag. Subscribers get the CVEs that match their own systems on My program, by email as they are published. Where the data comes from: sources.

Updated under an hour ago ()

What this means for you

This week: 5,432 CVEs published, 355 critical, and 7 newly confirmed exploited. Add your stack to see whether any of them hit you.

Do this next

Start free and add your stack

Free account, 1 product

Published in the last 7 days
5,432
Show in the list
Critical, last 7 days
355
Show in the list
Healthcare-tagged, last 7 days
4
Show in the list
Known exploited (CISA KEV)
1,747
Show in the list
Clear

Showing CVEs that name the product openemr:openemr. Show all products

138 CVEs, showing 1 to 50Page 1 of 3Next
CVESeverityTitlePublished
CVE-2006-2929
Healthcare
Medium 6.8PHP remote file inclusion vulnerability in contrib/forms/evaluation/C_FormEvaluation.class.php in OpenEMR 2.8.1 and earlier, when register_globals is enabled, allows remote attackers to execute arbit…
Assigned by mitre
Jun 9, 2006
CVE-2006-5795
Healthcare
High 7.5Multiple PHP remote file inclusion vulnerabilities in OpenEMR 2.8.1 and earlier, when register_globals is enabled, allow remote attackers to execute arbitrary PHP code via a URL in the srcdir paramet…
Assigned by mitre
Nov 8, 2006
CVE-2006-5811
Healthcare
Medium 6.8PHP remote file inclusion vulnerability in library/translation.inc.php in OpenEMR 2.8.1, with register_globals enabled, allows remote attackers to execute arbitrary PHP code via a URL in the GLOBALS[…
Assigned by mitre
Nov 8, 2006
CVE-2007-0649
Healthcare
Medium 4.3Variable overwrite vulnerability in interface/globals.php in OpenEMR 2.8.2 and earlier allows remote attackers to overwrite arbitrary program variables and conduct other unauthorized activities, such…
Assigned by mitre
Feb 1, 2007
CVE-2012-0992
Healthcare
High 8.5interface/fax/fax_dispatch.php in OpenEMR 4.1.0 allows remote authenticated users to execute arbitrary commands via shell metacharacters in the file parameter.
Assigned by mitre
Feb 7, 2012
CVE-2012-0991
Healthcare
Low 3.5Multiple directory traversal vulnerabilities in OpenEMR 4.1.0 allow remote authenticated users to read arbitrary files via a ..
Assigned by mitre
Feb 7, 2012
CVE-2022-1178
Healthcare
High 7.3Stored Cross Site Scripting in openemr/openemr
Assigned by @huntrdev
Mar 30, 2022
CVE-2022-1177
Healthcare
Medium 6.5Accounting User Can Download Patient Reports in openemr in openemr/openemr
Assigned by @huntrdev
Mar 30, 2022
CVE-2022-1181
Healthcare
High 8.0Stored Cross Site Scripting in openemr/openemr
Assigned by @huntrdev
Mar 30, 2022
CVE-2022-1180
Healthcare
Medium 4.6Reflected Cross Site Scripting in openemr/openemr
Assigned by @huntrdev
Mar 30, 2022
CVE-2022-1179
Healthcare
Medium 4.6Non-Privilege User Can Created New Rule and Lead to Stored Cross Site Scripting in openemr/openemr
Assigned by @huntrdev
Mar 30, 2022
CVE-2020-13567
Healthcare
High 8.8Multiple SQL injection vulnerabilities exist in phpGACL 3.3.7.
Assigned by talos
Apr 18, 2022
CVE-2022-1458
Healthcare
High 7.3Stored XSS Leads To Session Hijacking in openemr/openemr
Assigned by @huntrdev
Apr 25, 2022
CVE-2022-1459
Healthcare
High 8.3Non-Privilege User Can View Patient’s Disclosures in openemr/openemr
Assigned by @huntrdev
Apr 25, 2022
CVE-2022-1461
Healthcare
High 8.1Non Privilege User can Enable or Disable Registered in openemr/openemr
Assigned by @huntrdev
Apr 25, 2022
CVE-2022-2493
Healthcare
High 8.3Data Access from Outside Expected Data Manager Component in openemr/openemr
Assigned by @huntrdev
Jul 22, 2022
CVE-2022-2494
Healthcare
Medium 6.3Cross-site Scripting (XSS) - Stored in openemr/openemr
Assigned by @huntrdev
Jul 22, 2022
CVE-2022-2730
Healthcare
Medium 6.5Authorization Bypass Through User-Controlled Key in openemr/openemr
Assigned by @huntrdev
Aug 9, 2022
CVE-2022-2729
Healthcare
Medium 5.4Cross-site Scripting (XSS) - DOM in openemr/openemr
Assigned by @huntrdev
Aug 9, 2022
CVE-2022-2731
Healthcare
Medium 5.4Cross-site Scripting (XSS) - Reflected in openemr/openemr
Assigned by @huntrdev
Aug 9, 2022
CVE-2022-2733
Healthcare
Critical 9.6Cross-site Scripting (XSS) - Reflected in openemr/openemr
Assigned by @huntrdev
Aug 9, 2022
CVE-2022-2732
Healthcare
High 8.3Missing Authorization in openemr/openemr
Assigned by @huntrdev
Aug 9, 2022
CVE-2022-2734
Healthcare
Critical 10.0Improper Restriction of Rendered UI Layers or Frames in openemr/openemr
Assigned by @huntrdev
Aug 9, 2022
CVE-2022-2824
Healthcare
High 8.8Authorization Bypass Through User-Controlled Key in openemr/openemr
Assigned by @huntrdev
Aug 15, 2022
CVE-2022-4506
Healthcare
High 7.6Unrestricted Upload of File with Dangerous Type in openemr/openemr
Assigned by @huntrdev
Dec 15, 2022
CVE-2022-4505
Healthcare
High 8.8Authorization Bypass Through User-Controlled Key in openemr/openemr
Assigned by @huntrdev
Dec 15, 2022
CVE-2022-4504
Healthcare
High 7.1Improper Input Validation in openemr/openemr
Assigned by @huntrdev
Dec 15, 2022
CVE-2022-4503
Healthcare
Medium 6.4Cross-site Scripting (XSS) - Generic in openemr/openemr
Assigned by @huntrdev
Dec 15, 2022
CVE-2022-4502
Healthcare
High 7.3Cross-site Scripting (XSS) - Reflected in openemr/openemr
Assigned by @huntrdev
Dec 15, 2022
CVE-2022-4567
Healthcare
High 8.1Improper Access Control in openemr/openemr
Assigned by @huntrdev
Dec 17, 2022
CVE-2022-4615
Healthcare
High 8.3Cross-site Scripting (XSS) - Reflected in openemr/openemr
Assigned by @huntrdev
Dec 19, 2022
CVE-2022-4733
Healthcare
Medium 6.7Cross-site Scripting (XSS) - Stored in openemr/openemr
Assigned by @huntrdev
Dec 24, 2022
CVE-2023-2566
Healthcare
High 7.5Cross-site Scripting (XSS) - Stored in openemr/openemr
Assigned by @huntrdev
May 8, 2023
CVE-2023-2674
Healthcare
High 8.8Improper Access Control in openemr/openemr
Assigned by @huntrdev
May 12, 2023
CVE-2023-2947
Healthcare
Medium 4.7Cross-site Scripting (XSS) - Stored in openemr/openemr
Assigned by @huntrdev
May 27, 2023
CVE-2023-2946
Healthcare
Medium 6.3Improper Access Control in openemr/openemr
Assigned by @huntrdev
May 27, 2023
CVE-2023-2945
Healthcare
Medium 4.3Missing Authorization in openemr/openemr
Assigned by @huntrdev
May 27, 2023
CVE-2023-2944
Healthcare
Medium 6.3Improper Access Control in openemr/openemr
Assigned by @huntrdev
May 27, 2023
CVE-2023-2943
Healthcare
Medium 4.6Code Injection in openemr/openemr
Assigned by @huntrdev
May 27, 2023
CVE-2023-2942
Healthcare
High 8.1Improper Input Validation in openemr/openemr
Assigned by @huntrdev
May 27, 2023
CVE-2023-2950
Healthcare
Medium 6.3Improper Authorization in openemr/openemr
Assigned by @huntrdev
May 28, 2023
CVE-2023-2949
Healthcare
High 8.3Cross-site Scripting (XSS) - Reflected in openemr/openemr
Assigned by @huntrdev
May 28, 2023
CVE-2023-2948
Healthcare
High 8.3Cross-site Scripting (XSS) - Generic in openemr/openemr
Assigned by @huntrdev
May 28, 2023
CVE-2024-37734
Healthcare
Critical 9.8An issue in OpenEMR 7.0.2 allows a remote attacker to escalate privileges viaa crafted POST request using the noteid parameter.
Assigned by mitre
Jun 26, 2024
CVE-2024-0875
Healthcare
High 8.1Stored XSS in openemr/openemr
Assigned by @huntr_ai
Nov 15, 2024
CVE-2025-29789
Healthcare
Medium 4.6OpenEMR Has Directory Traversal in Load Code feature
Assigned by GitHub_M
Mar 25, 2025
CVE-2025-29772
Healthcare
High 7.2OpenEMR allows Reflected XSS in CAMOS new.php
Assigned by GitHub_M
Mar 31, 2025
CVE-2025-30149
Healthcare
Medium 6.4OpenEMR Reflected XSS in AJAX Script
Assigned by GitHub_M
Mar 31, 2025
CVE-2025-30161
Healthcare
High 8.4OpenEMR Stored XSS in OpenEMR Bronchitis Form
Assigned by GitHub_M
Mar 31, 2025
CVE-2025-31117
Healthcare
Medium 6.9OpenEMR Out-of-Band Server-Side Request Forgery (OOB SSRF) Vulnerability
Assigned by GitHub_M
Mar 31, 2025
Page 1 of 3Next

CVSS is the assigning CNA's score where it gives one, otherwise NVD's. The healthcare tag is a documented heuristic (a list of clinical and health IT vendors, and clinical terms in the description), not a classification. The CVE record is authoritative.

Your cookie choices
We use essential cookies to run this site, and, only with your consent, an advertising cookie from Google to measure whether our ads lead to sign-ups and subscriptions. See our for details.