# cve.now: Openemr

The newest entries naming Openemr as an affected vendor (up to 200), of 192 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-124490](https://cve.now/CVE-2026-124490.md): OpenEMR before 8.3.0 Arbitrary File Read/Write via oe-module-faxsms disposeDocument (CVSS 9.4)
- [CVE-2026-124489](https://cve.now/CVE-2026-124489.md): OpenEMR before 8.3.0 Broken Access Control via portal\_payment.php (CVSS 7.1)
- [CVE-2026-124488](https://cve.now/CVE-2026-124488.md): OpenEMR before 8.3.0 Authorization Bypass via load\_form.php High-Sensitivity Encounters (CVSS 8.6)
- [CVE-2026-124487](https://cve.now/CVE-2026-124487.md): OpenEMR before 8.4.0 Improper Authorization in FHIR DocumentReference $docref (CVSS 7.1)
- [CVE-2026-124486](https://cve.now/CVE-2026-124486.md): OpenEMR before 8.3.0 Missing Authorization in Classic Document Controller (CVSS 8.7)
- [CVE-2026-124485](https://cve.now/CVE-2026-124485.md): OpenEMR before 8.3.0 Cross-Patient Document Disclosure via Onsite Documents API (CVSS 7.1)
- [CVE-2026-124484](https://cve.now/CVE-2026-124484.md): OpenEMR before 8.4.0 Missing Authorization in Portal Onsite-Document APIs (CVSS 8.7)
- [CVE-2026-124483](https://cve.now/CVE-2026-124483.md): OpenEMR before 8.4.0 Improper Authorization via Prescription REST API (CVSS 8.7)
- [CVE-2026-124482](https://cve.now/CVE-2026-124482.md): OpenEMR before 8.4.0 Cross-Patient PHI Exfiltration via SMART Patient Launch (CVSS 7.1)
- [CVE-2026-124481](https://cve.now/CVE-2026-124481.md): OpenEMR before 8.4.0 Cross-Patient Payment Tampering via Rainforest Portal Payments (CVSS 7.1)
- [CVE-2026-124480](https://cve.now/CVE-2026-124480.md): OpenEMR before 8.4.0 Authorization Bypass via FHIR QuestionnaireResponse APICSRFTOKEN (CVSS 8.7)
- [CVE-2026-124479](https://cve.now/CVE-2026-124479.md): OpenEMR before 8.4.0 Arbitrary File Read via REST Document Download (CVSS 7.1)
- [CVE-2026-124478](https://cve.now/CVE-2026-124478.md): OpenEMR before 8.3.0 Missing Authorization via addRecall in save.php (CVSS 7.1)
- [CVE-2026-124477](https://cve.now/CVE-2026-124477.md): OpenEMR before 8.3.0 Missing Authorization via delete\_Recall in save.php (CVSS 8.7)
- [CVE-2026-124476](https://cve.now/CVE-2026-124476.md): OpenEMR before 8.3.0 IDOR via form\_pid in portal/lib/paylib.php (CVSS 7.1)
- [CVE-2026-124475](https://cve.now/CVE-2026-124475.md): OpenEMR before 8.3.0 IDOR via portal/lib/persist.php setting\_patient (CVSS 7.1)
- [CVE-2026-124473](https://cve.now/CVE-2026-124473.md): OpenEMR before 8.3.0 Broken Object Authorization via SOAP Note Update API (CVSS 7.1)
- [CVE-2026-124472](https://cve.now/CVE-2026-124472.md): OpenEMR before 8.3.0 Missing Authorization via sl\_eob\_patient\_note.php (CVSS 8.6)
- [CVE-2026-124471](https://cve.now/CVE-2026-124471.md): OpenEMR before 8.3.0 Missing Authorization and IDOR via sl\_eob\_invoice.php (CVSS 8.6)
- [CVE-2026-124470](https://cve.now/CVE-2026-124470.md): OpenEMR before 8.3.0 BOLA via portal\_custom\_report.php Exposes Patient Problem Lists (CVSS 7.1)
- [CVE-2026-124469](https://cve.now/CVE-2026-124469.md): OpenEMR before 8.3.0 SQL Injection via Fee Sheet warehouse parameter (CVSS 9.4)
- [CVE-2026-124468](https://cve.now/CVE-2026-124468.md): OpenEMR before 8.3.0 SQL Injection via Patient Insurance and Employer REST API (CVSS 7.1)
- [CVE-2026-124467](https://cve.now/CVE-2026-124467.md): OpenEMR before 8.4.0 Remote Code Execution via ESign LFI and fax upload (CVSS 8.7)
- [CVE-2026-124466](https://cve.now/CVE-2026-124466.md): OpenEMR before 8.4.0 Unauthenticated SSRF via OAuth2 Client jwks\_uri (CVSS 6.9)
- [CVE-2026-124464](https://cve.now/CVE-2026-124464.md): OpenEMR before 8.4.0 FHIR Patient Compartment Bypass via QuestionnaireResponse (CVSS 7.1)
- [CVE-2026-124463](https://cve.now/CVE-2026-124463.md): OpenEMR before 8.3.0 Stored XSS via CAMOS Rx Print View (CVSS 9.3)
- [CVE-2026-124462](https://cve.now/CVE-2026-124462.md): OpenEMR before 8.3.0 Patient Portal IDOR via Case-Sensitive Pid Parameter (CVSS 7.1)
- [CVE-2026-124461](https://cve.now/CVE-2026-124461.md): OpenEMR before 8.3.0 IDOR via DICOM library/ajax/upload.php Endpoint (CVSS 8.6)
- [CVE-2026-124460](https://cve.now/CVE-2026-124460.md): OpenEMR before 8.3.0 IDOR in Patient Portal PortalPatientController (CVSS 7.1)
- [CVE-2026-124459](https://cve.now/CVE-2026-124459.md): OpenEMR before 8.3.0 Cross-Patient IDOR via Encounter Form Viewers and Save Handlers (CVSS 8.6)
- [CVE-2026-124458](https://cve.now/CVE-2026-124458.md): OpenEMR before 8.4.0 FHIR Patient Compartment Bypass via Person Endpoint (CVSS 7.1)
- [CVE-2026-124457](https://cve.now/CVE-2026-124457.md): OpenEMR before 8.3.0 Path Traversal via sl\_eob\_process.php eraname (CVSS 7.2)
- [CVE-2026-124456](https://cve.now/CVE-2026-124456.md): OpenEMR before 8.3.0 Missing Authorization and IDOR in Prior-Authorizations Module (CVSS 7.1)
- [CVE-2026-124455](https://cve.now/CVE-2026-124455.md): OpenEMR before 8.3.0 IDOR via Portal OnsiteDocument Pid\_Equals Mass-Assignment (CVSS 7.1)
- [CVE-2026-124453](https://cve.now/CVE-2026-124453.md): OpenEMR before 8.3.0 IDOR in Portal Patient Settings via persist.php (CVSS 7.1)
- [CVE-2026-124452](https://cve.now/CVE-2026-124452.md): OpenEMR before 8.3.0 Stored XSS via Eye Exam Document Notes (CVSS 5.1)
- [CVE-2026-124451](https://cve.now/CVE-2026-124451.md): OpenEMR before 8.4.0 Authorization Bypass via checkUserHasAccessToPatient in SMART on FHIR (CVSS 6.0)
- [CVE-2026-124450](https://cve.now/CVE-2026-124450.md): OpenEMR before 8.3.0 Arbitrary File Read/Write via disposeDocument (CVSS 9.3)
- [CVE-2026-124449](https://cve.now/CVE-2026-124449.md): OpenEMR before 8.4.0 Missing Authorization via FHIR Media and QuestionnaireResponse Routes (CVSS 7.1)
- [CVE-2026-124448](https://cve.now/CVE-2026-124448.md): OpenEMR before 8.3.0 Stored XSS via CCDA/CCD Preview XSLT Attributes (CVSS 8.6)
- [CVE-2026-124447](https://cve.now/CVE-2026-124447.md): OpenEMR before 8.3.0 IDOR via OnsitePortalActivityController Update Endpoint (CVSS 8.6)
- [CVE-2026-124446](https://cve.now/CVE-2026-124446.md): OpenEMR before 8.3.0 Arbitrary File Read and Write via FaxSMS disposeDocument (CVSS 8.7)
- [CVE-2026-124445](https://cve.now/CVE-2026-124445.md): OpenEMR 7.0.1 before 8.4.0 OneTimeAuth Token Replay and PIN Brute Force (CVSS 9.3)
- [CVE-2026-124444](https://cve.now/CVE-2026-124444.md): OpenEMR before 8.4.0 SQL Injection via OnsiteDocument Query API (CVSS 7.1)
- [CVE-2026-102940](https://cve.now/CVE-2026-102940.md): OpenEMR: Missing Write ACL Allows Unauthorized Document Reassignment (CVSS 9.6)
- [CVE-2026-103021](https://cve.now/CVE-2026-103021.md): OpenEMR: Username Enumeration via Pre-Authentication User Settings Loading (CVSS 5.3)
- [CVE-2026-103020](https://cve.now/CVE-2026-103020.md): OpenEMR: Unauthenticated Information Disclosure in admin.php Exposes Database Names and Versions (CVSS 5.3)
- [CVE-2026-103019](https://cve.now/CVE-2026-103019.md): OpenEMR: Unauthenticated Open Redirect via OIDC End Session Endpoint (CVSS 4.3)
- [CVE-2026-104134](https://cve.now/CVE-2026-104134.md): OpenEMR: Missing authorization in person-search AJAX leaks patient demographics (name, DOB, phone, email) (CVSS 6.5)
- [CVE-2026-103939](https://cve.now/CVE-2026-103939.md): OpenEMR: Weno \`file\_download.php\`: missing ACL/CSRF truncates the e-prescribing pharmacy directory (CVSS 5.4)
- [CVE-2026-104138](https://cve.now/CVE-2026-104138.md): OpenEMR: Missing authorization on QRDA Category I/III download endpoints (CVSS 6.5)
- [CVE-2026-115573](https://cve.now/CVE-2026-115573.md): OpenEMR: Broken Access Control in controller.php Enables Insurance Routing Credential Hijack and PHI Enumeration (CVSS 8.1)
- [CVE-2026-104133](https://cve.now/CVE-2026-104133.md): OpenEMR: Missing authorization in DORN \`compendium\_install.php\` — non-admin destructive lab-compendium reinstall (CVSS 7.1)
- [CVE-2026-103935](https://cve.now/CVE-2026-103935.md): OpenEMR: Stored XSS via \`text()\` Misuse in Double-Quoted HTML Attribute (CVSS 8.1)
- [CVE-2026-104135](https://cve.now/CVE-2026-104135.md): OpenEMR: Missing authorization in payment patient-search AJAX leaks patient directory and dates of birth (CVSS 6.5)
- [CVE-2026-104136](https://cve.now/CVE-2026-104136.md): OpenEMR: Arbitrary Patient Recall and Contact Detail Read (CVSS 7.1)
- [CVE-2026-103938](https://cve.now/CVE-2026-103938.md): OpenEMR: CSRF Protection Bypass on IPPF Point-of-Sale Void and Regen Operations (CVSS 7.1)
- [CVE-2026-104137](https://cve.now/CVE-2026-104137.md): OpenEMR: Patient Data Search Without Sufficient ACL (CVSS 7.1)
- [CVE-2026-104139](https://cve.now/CVE-2026-104139.md): OpenEMR: Missing Authorization on Document Template Download Endpoint Allows Any Authenticated User to Read Another Patient's PHI (CVSS 6.5)
- [CVE-2026-65983](https://cve.now/CVE-2026-65983.md): OpenEMR FaxSMS module: insecure staging of decrypted patient documents in webroot (CVSS 7.5)
- [CVE-2026-49142](https://cve.now/CVE-2026-49142.md): OpenEMR Before 8.5.0 SQL Injection via form\_icd\_codes\[\] (CVSS 8.7)
- [CVE-2026-76614](https://cve.now/CVE-2026-76614.md): OpenEMR \< 8.3.0 Path Traversal Information Disclosure via EDI Archive Restore (CVSS 5.3)
- [CVE-2026-40509](https://cve.now/CVE-2026-40509.md): OpenEMR \< 8.3.0 CSRF via DICOM Viewer web\_path Parameter (CVSS 5.3)
- [CVE-2026-40508](https://cve.now/CVE-2026-40508.md): OpenEMR \< 8.3.0 Stored XSS via Patient Portal Template Import Handler (CVSS 5.1)
- [CVE-2026-40507](https://cve.now/CVE-2026-40507.md): OpenEMR \< 8.3.0 Reflected XSS via templateHtml Parameter in Patient Portal (CVSS 5.1)
- [CVE-2026-40506](https://cve.now/CVE-2026-40506.md): OpenEMR Path Traversal Arbitrary Directory Deletion via standard\_tables\_manage.php (CVSS 7.0)
- [CVE-2026-67612](https://cve.now/CVE-2026-67612.md): OpenEMR 8.2.0 Stored XSS via import\_template.php Template Management (CVSS 4.8)
- [CVE-2026-67611](https://cve.now/CVE-2026-67611.md): OpenEMR 8.2.0 OAuth2 Password Grant Authentication Bypass via SMART Configuration (CVSS 8.6)
- [CVE-2026-67610](https://cve.now/CVE-2026-67610.md): OpenEMR 8.2.0 OAuth2 Dynamic Client Registration Unauthorized FHIR Access (CVSS 8.6)
- [CVE-2026-39932](https://cve.now/CVE-2026-39932.md): OpenEMR 8.2.0 Remote Code Execution via CategoryTree eval() Injection (CVSS 9.4)
- [CVE-2026-39931](https://cve.now/CVE-2026-39931.md): OpenEMR Authenticated SQL Injection via backup.php Import Feature (CVSS 8.6)
- [CVE-2026-46518](https://cve.now/CVE-2026-46518.md): OpenEMR: Stored XSS in prescription CSS/HTML print view via patient demographics (CVSS 7.7)
- [CVE-2026-34056](https://cve.now/CVE-2026-34056.md): OpenEMR has a Privilege Escalation that Allows a Low-Level User to View Admin-Only Data (CVSS 7.7)
- [CVE-2026-34055](https://cve.now/CVE-2026-34055.md): OpenEMR has IDOR in Patient Notes Web UI allows unauthorized note access/modification (CVSS 8.1)
- [CVE-2026-34053](https://cve.now/CVE-2026-34053.md): OpenEMR Missing Authorization in Procedure Order AJAX Deletion Handler (CVSS 7.1)
- [CVE-2026-34051](https://cve.now/CVE-2026-34051.md): OpenEMR has Improper ACL On Import/Export Popup (CVSS 5.4)
- [CVE-2026-33934](https://cve.now/CVE-2026-33934.md): OpenEMR's Missing Authorization in show-signature.php Allows Portal Patients to Read Staff Signatures (CVSS 4.3)
- [CVE-2026-33933](https://cve.now/CVE-2026-33933.md): Reflected XSS via Unescaped contextName Parameter in Custom Template Editor (CVSS 6.1)
- [CVE-2026-33932](https://cve.now/CVE-2026-33932.md): OpenEMR has Stored XSS in CCDA Preview via Unsanitized linkHtml Attributes (CVSS 7.6)
- [CVE-2026-33931](https://cve.now/CVE-2026-33931.md): OpenEMR has IDOR in Portal Payment Page that Allows Cross-Patient Record Access (CVSS 6.5)
- [CVE-2026-33918](https://cve.now/CVE-2026-33918.md): OpenEMR Missing Authorization on Claim File Download Endpoint (CVSS 7.6)
- [CVE-2026-33917](https://cve.now/CVE-2026-33917.md): OpenEMR has SQL Injection in CAMOS Form (CVSS 8.8)
- [CVE-2026-33915](https://cve.now/CVE-2026-33915.md): OpenEMR Missing ACL Checks on Insurance Company API Routes (CVSS 5.4)
- [CVE-2026-33914](https://cve.now/CVE-2026-33914.md): OpenEMR has SQL Injection in PostCalendar Category Delete (CVSS 7.2)
- [CVE-2026-33913](https://cve.now/CVE-2026-33913.md): OpenEMR: XInclude Injection in CCDA Import Allows Reading Arbitrary Server Files (CVSS 7.7)
- [CVE-2026-33912](https://cve.now/CVE-2026-33912.md): OpenEMR has reflected XSS in ajax\_download.php via reportID parameter (CVSS 5.4)
- [CVE-2026-33911](https://cve.now/CVE-2026-33911.md): OpenEMR vulnerable to reflected XSS in graphs.php via title parameter (CVSS 5.4)
- [CVE-2026-33910](https://cve.now/CVE-2026-33910.md): OpenEMR has a SQL Injection Vulnerability in patient selection (CVSS 7.2)
- [CVE-2026-33909](https://cve.now/CVE-2026-33909.md): OpenEMR Vulnerable to SQL Injection via Unsanitized Variables in MedEx Recall/Reminder Processing (CVSS 5.9)
- [CVE-2026-33348](https://cve.now/CVE-2026-33348.md): OpenEMR has Stored XSS in patient encounter Eye Exam form $CHRONIC2 and $CHRONIC3 (CVSS 8.7)
- [CVE-2026-32120](https://cve.now/CVE-2026-32120.md): OpenEMR has IDOR in Fee Sheet Product Save (CVSS 6.5)
- [CVE-2026-29187](https://cve.now/CVE-2026-29187.md): OpenEMR Vulnerable to Authenticated Blind Boolean-Based SQL Injection in new\_search\_popup.php (CVSS 8.1)
- [CVE-2026-33346](https://cve.now/CVE-2026-33346.md): OpenEMR has stored XSS in portal\_payment.php via Unescaped table\_args (CVSS 8.7)
- [CVE-2026-33305](https://cve.now/CVE-2026-33305.md): OpenEMR has Authorization Bypass in FaxSMS AppDispatch Constructor (CVSS 5.4)
- [CVE-2026-33304](https://cve.now/CVE-2026-33304.md): OpenEMR has Authorization Bypass in Dated Reminders Log (CVSS 6.5)
- [CVE-2026-33303](https://cve.now/CVE-2026-33303.md): OpenEMR Vulnerable to Stored XSS via Unescaped portal\_login\_username in Credential Print View (CVSS 5.4)
- [CVE-2026-33302](https://cve.now/CVE-2026-33302.md): OpenEMR: zhAclCheck Ignores Explicit ACL Denies (CVSS 7.3)
- [CVE-2026-33321](https://cve.now/CVE-2026-33321.md): OpenEMR has Out-of-Band Server-Side Request Forgery (OOB SSRF) (CVSS 7.2)
- [CVE-2026-33301](https://cve.now/CVE-2026-33301.md): OpenEMR has arbitrary image file read via PDF generator (CVSS 7.1)
- [CVE-2026-33299](https://cve.now/CVE-2026-33299.md): OpenEMR has Stored XSS in patient encounter Eye Exam form answers (CVSS 8.5)
- [CVE-2026-32119](https://cve.now/CVE-2026-32119.md): OpenEMR has Stored DOM XSS via SearchHighlight text-node reconstruction on Custom Report page (CVSS 4.4)
- [CVE-2026-32238](https://cve.now/CVE-2026-32238.md): OpenEMR has Remote Code Execution in backup functionality (CVSS 9.1)
- [CVE-2026-25928](https://cve.now/CVE-2026-25928.md): OpenEMR Vulnerable to Path Traversal When Zipping DICOM Folders (CVSS 6.5)
- [CVE-2026-25744](https://cve.now/CVE-2026-25744.md): OpenEMR: POST /api/.../vital Accepts Attacker-Supplied id and Overwrites Arbitrary Vitals (CVSS 6.5)
- [CVE-2026-25745](https://cve.now/CVE-2026-25745.md): OpenEMR's Message Update Ignores Patient id (CVSS 6.5)
- [CVE-2026-32127](https://cve.now/CVE-2026-32127.md): SQL Injection Vulnerability in ajax graphs library (OpenEMR) (CVSS 8.8)
- [CVE-2026-32126](https://cve.now/CVE-2026-32126.md): OpenEMR: Inverted ACL Condition in CDR ControllerRouter Allows Any Authenticated User to Modify/Delete Clinical Rules and Plans (CVSS 7.1)
- [CVE-2026-32125](https://cve.now/CVE-2026-32125.md): OpenEMR: Stored XSS in Track Anything Graphs via Unescaped Dygraph Titles/Labels (CVSS 5.4)
- [CVE-2026-32124](https://cve.now/CVE-2026-32124.md): OpenEMR: Dynamic Code Picker Renders Unescaped Descriptions (Stored XSS) (CVSS 5.4)
- [CVE-2026-32123](https://cve.now/CVE-2026-32123.md): OpenEMR: Therapy Group Sensitivity ACL No Longer Enforced (CVSS 7.7)
- [CVE-2026-32122](https://cve.now/CVE-2026-32122.md): OpenEMR: Missing Authorization on Claim File Tracker UI and AJAX Endpoint (V2) (CVSS 4.3)
- [CVE-2026-32121](https://cve.now/CVE-2026-32121.md): OpenEMR: Stored DOM XSS via \`.html()\` in Portal Signer Modal (CVSS 7.7)
- [CVE-2026-32118](https://cve.now/CVE-2026-32118.md): OpenEMR has Stored XSS in Graphical Pain Map legend via unescaped annotation text (CVSS 5.4)
- [CVE-2026-24898](https://cve.now/CVE-2026-24898.md): OpenEMR has an Unauthenticated MedEx Token Disclosure (CVSS 10.0)
- [CVE-2026-25146](https://cve.now/CVE-2026-25146.md): OpenEMR's payments gateway\_api\_key secret rendered into client JS code (CVSS 9.6)
- [CVE-2026-24848](https://cve.now/CVE-2026-24848.md): OpenEMR Arbitrary File Write leading to Remote Code Execution (CVSS 8.7)
- [CVE-2026-25147](https://cve.now/CVE-2026-25147.md): OpenEMR's Portal Payment Endpoint Trusts User-Controlled pid (CVSS 7.1)
- [CVE-2026-24488](https://cve.now/CVE-2026-24488.md): OpenEMR Vulnerable to Arbitrary File Exfiltration via Fax Endpoint (CVSS 6.5)
- [CVE-2026-27943](https://cve.now/CVE-2026-27943.md): OpenEMR's Eye Exam View Trusts form\_id Without Verifying Patient/Encounter Ownership (CVSS 6.5)
- [CVE-2026-25930](https://cve.now/CVE-2026-25930.md): OpenEMR's Printable LBF Endpoint Leaks Arbitrary Patient Forms (CVSS 6.5)
- [CVE-2026-25929](https://cve.now/CVE-2026-25929.md): OpenEMR Patient Picture Context Allows Arbitrary Patient Photo Retrieval (CVSS 6.5)
- [CVE-2026-25927](https://cve.now/CVE-2026-25927.md): OpenEMR Missing Authorization Checks in DICOM Viewer State API (CVSS 7.1)
- [CVE-2026-25746](https://cve.now/CVE-2026-25746.md): OpenEMR has SQL Injection Vulnerability (CVSS 8.8)
- [CVE-2026-25743](https://cve.now/CVE-2026-25743.md): OpenEMR has Stored XSS in Questionnaire answers (CVSS 7.2)
- [CVE-2026-25476](https://cve.now/CVE-2026-25476.md): OpenEMR has Session Timeout Bypass via skip\_timeout\_reset (CVSS 7.5)
- [CVE-2026-25220](https://cve.now/CVE-2026-25220.md): OpenEMR Messages "Show All" Not Restricted to Admins (CVSS 5.7)
- [CVE-2026-25164](https://cve.now/CVE-2026-25164.md): OpenEMR's Document and Insurance REST Endpoints Skip ACL (CVSS 8.1)
- [CVE-2026-24908](https://cve.now/CVE-2026-24908.md): OpenEMR has SQL Injection in Patient API Sort Parameter (CVSS 10.0)
- [CVE-2026-24890](https://cve.now/CVE-2026-24890.md): OpenEMR Portal Users Can Forge Provider Signatures (CVSS 8.1)
- [CVE-2026-24487](https://cve.now/CVE-2026-24487.md): OpenEMR has FHIR Patient Compartment Bypass in CareTeam Resource (CVSS 5.7)
- [CVE-2026-23627](https://cve.now/CVE-2026-23627.md): OpenEMR has SQL Injection in Immunization Search/Report (CVSS 7.4)
- [CVE-2026-25135](https://cve.now/CVE-2026-25135.md): OpenEMR's location resource for Group.$export operation returns entire patient/user population contact information (CVSS 4.5)
- [CVE-2026-25131](https://cve.now/CVE-2026-25131.md): OpenEMR has Broken Access Control in Procedures Configuration (CVSS 8.8)
- [CVE-2026-25127](https://cve.now/CVE-2026-25127.md): OpenEMR has Broken Access Control on Care Coordination Module (CVSS 7.0)
- [CVE-2026-25124](https://cve.now/CVE-2026-25124.md): OpenEMR has Broken Access Control in Report/Clients/Message List CSV Export (CVSS 6.5)
- [CVE-2026-24896](https://cve.now/CVE-2026-24896.md): OpenEMR has Broken Access Control that allows unauthorized access to EDI Logs (CVSS 6.5)
- [CVE-2026-24849](https://cve.now/CVE-2026-24849.md): OpenEMR Arbitrary File Read Vulnerability (CVSS 10.0)
- [CVE-2026-24847](https://cve.now/CVE-2026-24847.md): OpenEMR has Open Redirect in Eye Exam Form (CVSS 6.1)
- [CVE-2026-21443](https://cve.now/CVE-2026-21443.md): OpenEMR allows inconsistent escaping of translation function output (CVSS 1.2)
- [CVE-2025-69231](https://cve.now/CVE-2025-69231.md): OpenEMR has a Stored XSS in GAD-7 Form that Enables Session Hijacking and Privilege Escalation (CVSS 8.7)
- [CVE-2025-68277](https://cve.now/CVE-2025-68277.md): OpenEMR allows links sent via Secure Messaging to be opened in OpenEMR and Portal (CVSS 7.2)
- [CVE-2025-67752](https://cve.now/CVE-2025-67752.md): OpenEMR Has Disabled SSL Certificate Verification in HTTP Client (CVSS 8.1)
- [CVE-2025-67491](https://cve.now/CVE-2025-67491.md): OpenEMR has Stored XSS in ub04 helper (CVSS 8.5)
- [CVE-2025-67645](https://cve.now/CVE-2025-67645.md): OpenEMR Vulnerable to Broken Access Control in Profile Edit Endpoint (CVSS 8.8)
- [CVE-2025-54373](https://cve.now/CVE-2025-54373.md): OpenEMR may expose Contents of Clinical Notes and Care Planto users who do not have Sensitivities=high privilege (CVSS 7.1)
- [CVE-2025-43860](https://cve.now/CVE-2025-43860.md): OpemEMR Vulnerable to Stored XSS Attack in the Additional Address Section of Patient Demographics (CVSS 7.6)
- [CVE-2025-32967](https://cve.now/CVE-2025-32967.md): OpenEMR doesn't log password administration properly (CVSS 5.4)
- [CVE-2025-32794](https://cve.now/CVE-2025-32794.md): OpenEMR Stored XSS via Patient Name Field in Procedure Orders (CVSS 7.6)
- [CVE-2025-31121](https://cve.now/CVE-2025-31121.md): OpenEMR allows XSS in Patient Image feature (CVSS 7.0)
- [CVE-2025-31117](https://cve.now/CVE-2025-31117.md): OpenEMR Out-of-Band Server-Side Request Forgery (OOB SSRF) Vulnerability (CVSS 6.9)
- [CVE-2025-30161](https://cve.now/CVE-2025-30161.md): OpenEMR Stored XSS in OpenEMR Bronchitis Form (CVSS 8.4)
- [CVE-2025-30149](https://cve.now/CVE-2025-30149.md): OpenEMR Reflected XSS in AJAX Script (CVSS 6.4)
- [CVE-2025-29772](https://cve.now/CVE-2025-29772.md): OpenEMR allows Reflected XSS in CAMOS new.php (CVSS 7.2)
- [CVE-2025-29789](https://cve.now/CVE-2025-29789.md): OpenEMR Has Directory Traversal in Load Code feature (CVSS 4.6)
- [CVE-2024-0875](https://cve.now/CVE-2024-0875.md): Stored XSS in openemr/openemr (CVSS 8.1)
- [CVE-2023-2950](https://cve.now/CVE-2023-2950.md): Improper Authorization in openemr/openemr (CVSS 6.3)
- [CVE-2023-2949](https://cve.now/CVE-2023-2949.md): Cross-site Scripting (XSS) - Reflected in openemr/openemr (CVSS 8.3)
- [CVE-2023-2948](https://cve.now/CVE-2023-2948.md): Cross-site Scripting (XSS) - Generic in openemr/openemr (CVSS 8.3)
- [CVE-2023-2947](https://cve.now/CVE-2023-2947.md): Cross-site Scripting (XSS) - Stored in openemr/openemr (CVSS 4.7)
- [CVE-2023-2946](https://cve.now/CVE-2023-2946.md): Improper Access Control in openemr/openemr (CVSS 6.3)
- [CVE-2023-2945](https://cve.now/CVE-2023-2945.md): Missing Authorization in openemr/openemr (CVSS 4.3)
- [CVE-2023-2944](https://cve.now/CVE-2023-2944.md): Improper Access Control in openemr/openemr (CVSS 6.3)
- [CVE-2023-2943](https://cve.now/CVE-2023-2943.md): Code Injection in openemr/openemr (CVSS 4.6)
- [CVE-2023-2942](https://cve.now/CVE-2023-2942.md): Improper Input Validation in openemr/openemr (CVSS 8.1)
- [CVE-2023-2674](https://cve.now/CVE-2023-2674.md): Improper Access Control in openemr/openemr (CVSS 8.8)
- [CVE-2023-2566](https://cve.now/CVE-2023-2566.md): Cross-site Scripting (XSS) - Stored in openemr/openemr (CVSS 7.5)
- [CVE-2022-4733](https://cve.now/CVE-2022-4733.md): Cross-site Scripting (XSS) - Stored in openemr/openemr (CVSS 6.7)
- [CVE-2022-4615](https://cve.now/CVE-2022-4615.md): Cross-site Scripting (XSS) - Reflected in openemr/openemr (CVSS 8.3)
- [CVE-2022-4567](https://cve.now/CVE-2022-4567.md): Improper Access Control in openemr/openemr (CVSS 8.1)
- [CVE-2022-4506](https://cve.now/CVE-2022-4506.md): Unrestricted Upload of File with Dangerous Type in openemr/openemr (CVSS 7.6)
- [CVE-2022-4505](https://cve.now/CVE-2022-4505.md): Authorization Bypass Through User-Controlled Key in openemr/openemr (CVSS 8.8)
- [CVE-2022-4504](https://cve.now/CVE-2022-4504.md): Improper Input Validation in openemr/openemr (CVSS 7.1)
- [CVE-2022-4503](https://cve.now/CVE-2022-4503.md): Cross-site Scripting (XSS) - Generic in openemr/openemr (CVSS 6.4)
- [CVE-2022-4502](https://cve.now/CVE-2022-4502.md): Cross-site Scripting (XSS) - Reflected in openemr/openemr (CVSS 7.3)
- [CVE-2022-2824](https://cve.now/CVE-2022-2824.md): Authorization Bypass Through User-Controlled Key in openemr/openemr (CVSS 8.8)
- [CVE-2022-2734](https://cve.now/CVE-2022-2734.md): Improper Restriction of Rendered UI Layers or Frames in openemr/openemr (CVSS 10.0)
- [CVE-2022-2732](https://cve.now/CVE-2022-2732.md): Missing Authorization in openemr/openemr (CVSS 8.3)
- [CVE-2022-2733](https://cve.now/CVE-2022-2733.md): Cross-site Scripting (XSS) - Reflected in openemr/openemr (CVSS 9.6)
- [CVE-2022-2731](https://cve.now/CVE-2022-2731.md): Cross-site Scripting (XSS) - Reflected in openemr/openemr (CVSS 5.4)
- [CVE-2022-2729](https://cve.now/CVE-2022-2729.md): Cross-site Scripting (XSS) - DOM in openemr/openemr (CVSS 5.4)
- [CVE-2022-2730](https://cve.now/CVE-2022-2730.md): Authorization Bypass Through User-Controlled Key in openemr/openemr (CVSS 6.5)
- [CVE-2022-2494](https://cve.now/CVE-2022-2494.md): Cross-site Scripting (XSS) - Stored in openemr/openemr (CVSS 6.3)
- [CVE-2022-2493](https://cve.now/CVE-2022-2493.md): Data Access from Outside Expected Data Manager Component in openemr/openemr (CVSS 8.3)
- [CVE-2022-1461](https://cve.now/CVE-2022-1461.md): Non Privilege User can Enable or Disable Registered in openemr/openemr (CVSS 8.1)
- [CVE-2022-1459](https://cve.now/CVE-2022-1459.md): Non-Privilege User Can View Patient’s Disclosures in openemr/openemr (CVSS 8.3)
- [CVE-2022-1458](https://cve.now/CVE-2022-1458.md): Stored XSS Leads To Session Hijacking in openemr/openemr (CVSS 7.3)
- [CVE-2020-13567](https://cve.now/CVE-2020-13567.md): Multiple SQL injection vulnerabilities exist in phpGACL 3.3.7. (CVSS 8.8)
- [CVE-2022-1179](https://cve.now/CVE-2022-1179.md): Non-Privilege User Can Created New Rule and Lead to Stored Cross Site Scripting in openemr/openemr (CVSS 4.6)
- [CVE-2022-1180](https://cve.now/CVE-2022-1180.md): Reflected Cross Site Scripting in openemr/openemr (CVSS 4.6)
- [CVE-2022-1181](https://cve.now/CVE-2022-1181.md): Stored Cross Site Scripting in openemr/openemr (CVSS 8.0)
- [CVE-2022-1177](https://cve.now/CVE-2022-1177.md): Accounting User Can Download Patient Reports in openemr in openemr/openemr (CVSS 6.5)
- [CVE-2022-1178](https://cve.now/CVE-2022-1178.md): Stored Cross Site Scripting in openemr/openemr (CVSS 7.3)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/openemr
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.