Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 3

Export CSV
CVE-2026-82583

NextGen Healthcare Mirth Connect SQL Injection

NextGen Connect (Mirth Connect) versions 4.7.1 and earlier allow an authenticated user to execute arbitrary SQL through a Database Connector API, which could result in disclosure of stored credentials for connected systems, arbitrary file write, and a denial-of-service condition.

CVSS 4.0 · 7.2 High EPSS < 1% KEV · Not listed
Vendors
Nextgen Healthcare
Products
Mirth Connect
CVE-2026-78224

NextGen Healthcare Mirth Connect Improper Restriction of XML External Entity Reference

The XSLT Transformer Step builds a bare TransformerFactory without the proper security options set, so XXE injection can allow data exfiltration and denial-of-service attacks.

CVSS 4.0 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Nextgen Healthcare
Products
Mirth Connect
CVE-2026-82578

NextGen Healthcare Mirth Connect Improper Restriction of XML External Entity Reference

When XML batch processing is turned on and the XPath option is selected, the raw batch input goes through a default XPath/JAXP setup with no entity restrictions, so XXE injection can allow data exfiltration and denial-of-service attacks.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Nextgen Healthcare
Products
Mirth Connect