Openemr vulnerabilities
192 CVEs and advisories name Openemr as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-124458OpenEMR before 8.4.0 FHIR Patient Compartment Bypass via Person Endpoint
- CVE-2026-124457OpenEMR before 8.3.0 Path Traversal via sl_eob_process.php eraname
- CVE-2026-124456OpenEMR before 8.3.0 Missing Authorization and IDOR in Prior-Authorizations Module
- CVE-2026-124455OpenEMR before 8.3.0 IDOR via Portal OnsiteDocument Pid_Equals Mass-Assignment
- CVE-2026-124453OpenEMR before 8.3.0 IDOR in Portal Patient Settings via persist.php
- CVE-2026-124452OpenEMR before 8.3.0 Stored XSS via Eye Exam Document Notes
- CVE-2026-124451OpenEMR before 8.4.0 Authorization Bypass via checkUserHasAccessToPatient in SMART on FHIR
- CVE-2026-124450OpenEMR before 8.3.0 Arbitrary File Read/Write via disposeDocument
- CVE-2026-124449OpenEMR before 8.4.0 Missing Authorization via FHIR Media and QuestionnaireResponse Routes
- CVE-2026-124448OpenEMR before 8.3.0 Stored XSS via CCDA/CCD Preview XSLT Attributes
- CVE-2026-124447OpenEMR before 8.3.0 IDOR via OnsitePortalActivityController Update Endpoint
- CVE-2026-124446OpenEMR before 8.3.0 Arbitrary File Read and Write via FaxSMS disposeDocument
- CVE-2026-124445OpenEMR 7.0.1 before 8.4.0 OneTimeAuth Token Replay and PIN Brute Force
- CVE-2026-124444OpenEMR before 8.4.0 SQL Injection via OnsiteDocument Query API
- CVE-2026-102940OpenEMR: Missing Write ACL Allows Unauthorized Document Reassignment
- CVE-2026-103021OpenEMR: Username Enumeration via Pre-Authentication User Settings Loading
- CVE-2026-103020OpenEMR: Unauthenticated Information Disclosure in admin.php Exposes Database Names and Versions
- CVE-2026-103019OpenEMR: Unauthenticated Open Redirect via OIDC End Session Endpoint
- CVE-2026-104134OpenEMR: Missing authorization in person-search AJAX leaks patient demographics (name, DOB, phone, email)
- CVE-2026-103939OpenEMR: Weno `file_download.php`: missing ACL/CSRF truncates the e-prescribing pharmacy directory
- CVE-2026-104138OpenEMR: Missing authorization on QRDA Category I/III download endpoints
- CVE-2026-115573OpenEMR: Broken Access Control in controller.php Enables Insurance Routing Credential Hijack and PHI Enumeration
- CVE-2026-104133OpenEMR: Missing authorization in DORN `compendium_install.php` — non-admin destructive lab-compendium reinstall
- CVE-2026-103935OpenEMR: Stored XSS via `text()` Misuse in Double-Quoted HTML Attribute
- CVE-2026-104135OpenEMR: Missing authorization in payment patient-search AJAX leaks patient directory and dates of birth
- CVE-2026-104136OpenEMR: Arbitrary Patient Recall and Contact Detail Read
- CVE-2026-103938OpenEMR: CSRF Protection Bypass on IPPF Point-of-Sale Void and Regen Operations
- CVE-2026-104137OpenEMR: Patient Data Search Without Sufficient ACL
- CVE-2026-104139OpenEMR: Missing Authorization on Document Template Download Endpoint Allows Any Authenticated User to Read Another Patient's PHI
- CVE-2026-65983OpenEMR FaxSMS module: insecure staging of decrypted patient documents in webroot