Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 192

Export CSV
CVE-2026-126441

OpenEMR before 8.5.0 IDOR via CAMOS rx_print.php Prescription Disclosure

OpenEMR before 8.5.0 contains an insecure direct object reference vulnerability in the CAMOS rx_print.php printer that allows authenticated users to read other patients' prescriptions. Attackers can submit forged chrx_ parameters with global prescription IDs to disclose drug names, dosages, directions, and refill counts without medication permissions.

CVSS 4.0 · 6 Medium EPSS < 1% KEV · Not listed
Vendors
Open-emr Openemr
Products
Openemr Openemr
CVE-2026-126439

OpenEMR before 8.5.0 Authorization Bypass via C-CDA Gateway ccda_gateway.php

OpenEMR before 8.5.0 contains a missing authorization vulnerability in ccdaservice/ccda_gateway.php that fails to enforce the patients/pat_rep permission, accepting any authenticated core session. Authenticated users without patient-report permission can request the report_ccd_view action to retrieve the selected patient's C-CDA clinical summary, including diagnoses, medications, laboratory results, and identifiers.

CVSS 4.0 · 6 Medium EPSS < 1% KEV · Not listed
Vendors
Open-emr Openemr
Products
Openemr Openemr
CVE-2026-126437

OpenEMR before 8.5.0 Authorization Bypass via portal/lib/download_template.php

OpenEMR before 8.5.0 contains an authorization bypass vulnerability in portal/lib/download_template.php that allows any authenticated core user to render documents for arbitrary patients by setting isModule. Attackers can submit arbitrary pid and template_id values to disclose patient names, birth dates, chart IDs, addresses, allergies, medications, and problem lists despite ACL and squad restrictions.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Open-emr Openemr
Products
Openemr Openemr
CVE-2026-126436

OpenEMR before 8.5.0 OAuth2 Grant Type Enforcement Bypass via Token Endpoint

OpenEMR before 8.5.0 contains an authorization bypass vulnerability that allows OAuth2 clients to use unregistered grant types because oauth_clients.grant_types is never enforced. Attackers can request tokens with grant_type=password to bypass the user consent screen, and disabled clients can redeem authorization codes using JWT client assertions.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Open-emr Openemr
Products
Openemr Openemr
CVE-2026-126432

OpenEMR before 8.5.0 Improper Authorization in Lab Order Transmission via list_reports.php

OpenEMR before 8.5.0 contains an improper authorization vulnerability in interface/orders/list_reports.php that allows read-only users to transmit lab orders because the patients/med check ignores write permission. Authenticated attackers can submit form_xmit with arbitrary procedure order IDs to send HL7 orders containing SSNs, insurance, and diagnoses to laboratories and mark them transmitted.

CVSS 4.0 · 6 Medium EPSS < 1% KEV · Not listed
Vendors
Open-emr Openemr
Products
Openemr Openemr
CVE-2026-126431

OpenEMR before 8.5.0 Second-Order SQL Injection via Carecoordination CCDA Mapper

OpenEMR before 8.5.0 contains a second-order sql injection vulnerability that allows authenticated Carecoordination users to store malicious C-CDA field identifiers through the savedata action. Attackers can inject SQL into the IN clause built by fetchFormValues() during C-CDA generation to extract password hashes, portal reset values, and patient records.

CVSS 4.0 · 7.6 High EPSS < 1% KEV · Not listed
Vendors
Open-emr Openemr
Products
Openemr Openemr
CVE-2026-126428

OpenEMR before 8.5.0 RCE via Stored ERA Upload and Background Services

OpenEMR before 8.5.0 contains a remote code execution vulnerability that allows authenticated billing users to store attacker-controlled PHP by uploading a malformed ERA file to era_payments.php. Attackers with a database-write primitive such as SQL injection can register a background_services row whose require_once loads the stored .edi file, executing PHP as the web-server user.

CVSS 4.0 · 7.7 High EPSS < 1% KEV · Not listed
Vendors
Open-emr Openemr
Products
Openemr Openemr
CVE-2026-126426

OpenEMR 5.0.2 before 8.5.0 Missing Re-Authentication for MFA Factor Deletion and U2F Registration

OpenEMR 5.0.2 before 8.5.0 contains a missing authentication vulnerability in mfa_registrations.php and mfa_u2f.php that allows session hijackers to delete MFA factors or register U2F keys without password re-entry. Attackers holding a victim's authenticated session can remove all second factors or add their own U2F key, bypassing MFA at later logins with the password.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Open-emr Openemr
Products
Openemr Openemr
CVE-2026-126425

OpenEMR before 8.5.0 Stored SQL Injection via History Layout Field Identifiers

OpenEMR before 8.5.0 contains a stored SQL injection vulnerability in which History layout field identifiers saved through edit_layout.php, including HIS fields and LBF source-H fields, are placed unvalidated into an INSERT statement for patients without a history_data row. Users with admin/super and patients/med write access can trigger history_save.php or LBF saves to execute SQL functions like SLEEP, tying up database workers or accessing data beyond their privileges.

CVSS 4.0 · 4.6 Medium EPSS < 1% KEV · Not listed
Vendors
Open-emr Openemr
Products
Openemr Openemr
CVE-2026-126422

OpenEMR before 8.5.0 Missing Authorization via lists_touch.php

OpenEMR before 8.5.0 contains a missing authorization vulnerability in library/ajax/lists_touch.php that allows restricted authenticated users to mark another patient's clinical lists as reviewed. Attackers can submit arbitrary patient_id and type values to falsely record "None known" allergy, medication, or problem lists, misleading clinicians and skewing quality-measure calculations.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Open-emr Openemr
Products
Openemr Openemr
CVE-2026-126421

OpenEMR before 8.5.0 Denial of Service via labs_ajax.php Label Count

OpenEMR before 8.5.0 contains an uncontrolled resource consumption vulnerability that allows authenticated users with patients/med access to exhaust PHP workers via an unbounded count parameter. Attackers can send print_labels requests to labs_ajax.php with huge counts, forcing mPDF page and barcode generation that makes OpenEMR unavailable.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Open-emr Openemr
Products
Openemr Openemr
CVE-2026-126420

OpenEMR before 8.5.0 Missing Authorization in FaxSMS utility.php Patient Creation

OpenEMR before 8.5.0 contains a missing authorization vulnerability in the FaxSMS module's utility.php that allows read-only demographics users to create patient charts. Attackers can submit the form_create request with chosen identity fields to create fictitious or duplicate patients with employer, history, and insurance records.

CVSS 4.0 · 6 Medium EPSS < 1% KEV · Not listed
Vendors
Open-emr Openemr
Products
Openemr Openemr
CVE-2026-126419

OpenEMR before 8.5.0 Missing Authorization in E-Sign Form Submission

OpenEMR before 8.5.0 contains a missing authorization vulnerability in the esign_form_submit handler of library/ESign/Form/Controller.php that verifies only the caller's password, not access to the patient, encounter, or form type. Authenticated core users can supply arbitrary formId, formDir, and encounterId values to sign and lock any patient's clinical form, creating unauthorized approval records and blocking normal editing.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Open-emr Openemr
Products
Openemr Openemr
CVE-2026-126418

OpenEMR before 8.5.0 Stored XSS via Billing Code in sl_eob_invoice.php

OpenEMR before 8.5.0 contains a stored cross-site scripting vulnerability in interface/billing/sl_eob_invoice.php, which escapes billing codes for HTML attributes but not for JavaScript strings in an inline onkeyup handler. Clinicians with encounter coding access can save crafted billing codes through diagnosis.php that execute script when a Back Office user enters a payment, exposing patient and financial data or performing actions as that user.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Open-emr Openemr
Products
Openemr Openemr
CVE-2026-126417

OpenEMR before 8.5.0 Information Disclosure via get_claim_file.php

OpenEMR before 8.5.0 contains an access control flaw in get_claim_file.php: with location=tmp, it serves any file in the shared temporary directory without verifying the file is a claim for the caller. Users with acct/eob or acct/bill write access can request key=ccda.xml to download the most recently validated patient's complete C-CDA clinical document.

CVSS 4.0 · 6 Medium EPSS < 1% KEV · Not listed
Vendors
Open-emr Openemr
Products
Openemr Openemr
CVE-2026-126416

OpenEMR before 8.5.0 Improper Authorization via patient_tracker_status.php

OpenEMR before 8.5.0 contains an improper authorization vulnerability in patient_tracker_status.php that allows low-privilege authenticated users to modify other patients' tracker entries by supplying arbitrary tracker_id values. Attackers can post statustype and roomnum parameters with a valid CSRF token to alter patient-flow status, room assignments, and linked calendar appointment state.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Open-emr Openemr
Products
Openemr Openemr
CVE-2026-126415

OpenEMR before 8.5.0 Missing Authorization via Patientvalidation Module

OpenEMR before 8.5.0 contains a missing authorization vulnerability in the Patient Validation module that allows any authenticated user to retrieve patient demographic records. Attackers can send direct requests with wildcard mf_lname or empty mf_ parameters to the patientvalidation endpoint to enumerate the entire patient_data table.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Open-emr Openemr
Products
Openemr Openemr
CVE-2026-124473

OpenEMR before 8.3.0 Broken Object Authorization via SOAP Note Update API

OpenEMR before 8.3.0 contains a broken object-level authorization vulnerability in the SOAP note update API, which does not verify that the supplied SOAP note ID (sid) belongs to the supplied patient and encounter. Authenticated users with encounters/notes permission can send PUT requests to /api/patient/:pid/encounter/:eid/soap_note/:sid with another patient's sid to overwrite that clinical note and reassign its pid.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Open-emr Openemr
Products
Openemr Openemr
CVE-2026-124447

OpenEMR before 8.3.0 IDOR via OnsitePortalActivityController Update Endpoint

OpenEMR before 8.3.0 contains an insecure direct object reference vulnerability in OnsitePortalActivityController::Update() that checks the request's patientId instead of the stored record's owner. Authenticated portal patients can send PUT requests to the onsiteportalactivity API with another patient's activity id and their own patientId to disclose tableArgs and checksum data, overwrite narratives and status, and take ownership of the record.

CVSS 4.0 · 8.6 High EPSS < 1% KEV · Not listed
Vendors
Open-emr Openemr
Products
Openemr Openemr
CVE-2026-102940

OpenEMR: Missing Write ACL Allows Unauthorized Document Reassignment

OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.4.0, controllers/C_Document.class.php write actions, including move_action_process(), do not verify the caller's access to the source document, current patient and category, or destination patient and category before Document::change_patient() performs the mutation. A low-privilege authenticated user can reassign an arbitrary document to a patient or category the user can access and then retrieve it through the normally protected read path. The reassignment occurs before a later list rendering check, so a final HTTP 403 response does not mean the unauthorized write was blocked. This issue is fixed in version 8.4.0.

CVSS 3.1 · 9.6 Critical EPSS < 1% KEV · Not listed
Vendors
Open-emr Openemr
Products
Openemr Openemr