Skip to content
Noroxi

Open-Emr records

238 published records for vendor Open-Emr. 0 of them have been exploited in the wild (listed in CISA KEV) and 2 have a ready-made attack tool.

Filter by product ↓

Researcher profile

Entered KEV
0 · 0%
Weaponized
2 · 0.8%
Pre-auth RCE
11
With a fix record
15.5%
Median publish → KEV
No record has entered KEV

Pre-auth RCE: flaws that let an attacker run code over the network without an account. Median publish → KEV: the typical time between a record being published and CISA listing it as exploited.

Records by year

  1. 17
  2. 18
  3. 19
  4. 20
  5. 21
  6. 22
  7. 23
  8. 24
  9. 25
  10. 26

Bar: total · dark part: CISA KEV.

Recurring classes

The weakness classes this vendor ships most often: where to look.

CWE

Attack profile

All records

238 records
  • CVE-2018-17179
    60This week

    An issue was discovered in OpenEMR before 5.0.1 Patch 7.

    CriticalCVSS 9.8WeaponizedEPSS 12%

    open-emr · openemrMay 17, 2019

  • CVE-2020-19364
    56Plan

    OpenEMR 5.0.1 allows an authenticated attacker to upload and execute malicious PHP scripts through /controller.php.

    HighCVSS 8.8No exploitEPSS 70%

    open-emr · openemrJan 19, 2021

  • CVE-2019-14530
    55Plan

    An issue was discovered in custom/ajax_download.php in OpenEMR before 5.0.2 via the fileName parameter.

    HighCVSS 8.8Proof of conceptEPSS 65%

    open-emr · openemrAug 13, 2019

  • CVE-2020-36243
    54Plan

    The Patient Portal of OpenEMR 5.0.2.1 is affected by a Command Injection vulnerability in /interface/main/backup.php.

    HighCVSS 8.8No exploitEPSS 64%

    open-emr · openemrFeb 7, 2021

  • CVE-2023-2948
    53Plan

    Cross-site Scripting (XSS) - Generic in openemr/openemr

    MediumCVSS 6.1Proof of conceptEPSS 96%

    open-emr · openemrMay 28, 2023

  • CVE-2022-2733
    53Plan

    Cross-site Scripting (XSS) - Reflected in openemr/openemr

    MediumCVSS 6.1Proof of conceptEPSS 95%

    open-emr · openemrAug 9, 2022

  • CVE-2018-15153
    53Plan

    OS command injection occurring in versions of OpenEMR before 5.0.1.4 allows a remote authenticated attacker to execute arbitrary commands by

    HighCVSS 8.8No exploitEPSS 61%

    open-emr · openemrAug 15, 2018

  • CVE-2021-25921
    48Plan

    In OpenEMR, versions 2.7.3-rc1 to 6.0.0 are vulnerable to Stored Cross-Site-Scripting (XSS) due to user input not being validated properly i

    MediumCVSS 5.4No exploitEPSS 89%

    open-emr · openemrMar 22, 2021

  • CVE-2020-13562
    47Plan

    A cross-site scripting vulnerability exists in the template functionality of phpGACL 3.3.7.

    MediumCVSS 6.1No exploitEPSS 77%

    phpgacl project · phpgaclFeb 1, 2021

  • CVE-2020-13564
    47Plan

    A cross-site scripting vulnerability exists in the template functionality of phpGACL 3.3.7.

    MediumCVSS 6.1No exploitEPSS 75%

    phpgacl project · phpgaclFeb 1, 2021

  • CVE-2020-13563
    47Plan

    A cross-site scripting vulnerability exists in the template functionality of phpGACL 3.3.7.

    MediumCVSS 6.1No exploitEPSS 75%

    phpgacl project · phpgaclFeb 1, 2021

  • CVE-2019-14529
    47Plan

    OpenEMR before 5.0.2 allows SQL Injection in interface/forms/eye_mag/save.php.

    CriticalCVSS 9.8Proof of conceptEPSS 28%

    open-emr · openemrAug 2, 2019

  • CVE-2023-2947
    46Plan

    Cross-site Scripting (XSS) - Stored in openemr/openemr

    MediumCVSS 4.8No exploitEPSS 90%

    open-emr · openemrMay 27, 2023

  • CVE-2022-1179
    44Plan

    Non-Privilege User Can Created New Rule and Lead to Stored Cross Site Scripting in openemr/openemr

    MediumCVSS 5.4No exploitEPSS 76%

    open-emr · openemrMar 30, 2022

  • CVE-2018-9250
    44Plan

    interface\super\edit_list.php in OpenEMR before v5_0_1_1 allows remote authenticated users to execute arbitrary SQL commands via the newlist

    HighCVSS 8.8No exploitEPSS 30%

    open-emr · openemrMay 18, 2018

  • CVE-2020-13568
    44Plan

    SQL injection vulnerability exists in phpGACL 3.3.7.

    HighCVSS 8.8No exploitEPSS 29%

    open-emr · openemrApr 13, 2021

  • CVE-2018-15152
    44Plan

    Authentication bypass vulnerability in portal/account/register.php in versions of OpenEMR before 5.0.1.4 allows a remote attacker to access

    CriticalCVSS 9.1Proof of conceptEPSS 25%

    open-emr · openemrAug 15, 2018

  • CVE-2018-15139
    41Plan

    Unrestricted file upload in interface/super/manage_site_files.php in versions of OpenEMR before 5.0.1.4 allows a remote authenticated attack

    HighCVSS 8.8Proof of conceptEPSS 19%

    open-emr · openemrAug 13, 2018

  • CVE-2024-22611
    41Plan

    OpenEMR 7.0.2 is vulnerable to SQL Injection via \openemr\library\classes\Pharmacy.class.php, \controllers\C_Pharmacy.class.php and \openemr

    CriticalCVSS 9.8No exploitEPSS 6%

    open-emr · openemrApr 3, 2025

  • CVE-2019-3963
    40Plan

    In OpenEMR 5.0.1 and earlier, controller.php contains a reflected XSS vulnerability in the patient_id parameter.

    MediumCVSS 6.1No exploitEPSS 52%

    open-emr · openemrAug 20, 2019

  • CVE-2019-3964
    40Plan

    In OpenEMR 5.0.1 and earlier, controller.php contains a reflected XSS vulnerability in the doc_id parameter.

    MediumCVSS 6.1No exploitEPSS 52%

    open-emr · openemrAug 20, 2019

  • CVE-2018-15142
    40Plan

    Directory traversal in portal/import_template.php in versions of OpenEMR before 5.0.1.4 allows a remote attacker authenticated in the patien

    HighCVSS 8.8Proof of conceptEPSS 17%

    open-emr · openemrAug 13, 2018

  • CVE-2017-9380
    40Plan

    OpenEMR 5.0.0 and prior allows low-privilege users to upload files of dangerous types which can result in arbitrary code execution within th

    HighCVSS 8.8Proof of conceptEPSS 15%

    open-emr · openemrJun 2, 2017

  • CVE-2026-24898
    40Plan

    OpenEMR has an Unauthenticated MedEx Token Disclosure

    CriticalCVSS 9.8Proof of conceptEPSS 2%

    open-emr · openemrMar 3, 2026

  • CVE-2020-13567
    40Plan

    Multiple SQL injection vulnerabilities exist in phpGACL 3.3.7.

    CriticalCVSS 9.8No exploitEPSS 2%

    open-emr · openemrApr 18, 2022