Openemr vulnerabilities
192 CVEs and advisories name Openemr as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-32120OpenEMR has IDOR in Fee Sheet Product Save
- CVE-2026-29187OpenEMR Vulnerable to Authenticated Blind Boolean-Based SQL Injection in new_search_popup.php
- CVE-2026-33346OpenEMR has stored XSS in portal_payment.php via Unescaped table_args
- CVE-2026-33305OpenEMR has Authorization Bypass in FaxSMS AppDispatch Constructor
- CVE-2026-33304OpenEMR has Authorization Bypass in Dated Reminders Log
- CVE-2026-33303OpenEMR Vulnerable to Stored XSS via Unescaped portal_login_username in Credential Print View
- CVE-2026-33302OpenEMR: zhAclCheck Ignores Explicit ACL Denies
- CVE-2026-33321OpenEMR has Out-of-Band Server-Side Request Forgery (OOB SSRF)
- CVE-2026-33301OpenEMR has arbitrary image file read via PDF generator
- CVE-2026-33299OpenEMR has Stored XSS in patient encounter Eye Exam form answers
- CVE-2026-32119OpenEMR has Stored DOM XSS via SearchHighlight text-node reconstruction on Custom Report page
- CVE-2026-32238OpenEMR has Remote Code Execution in backup functionality
- CVE-2026-25928OpenEMR Vulnerable to Path Traversal When Zipping DICOM Folders
- CVE-2026-25744OpenEMR: POST /api/.../vital Accepts Attacker-Supplied id and Overwrites Arbitrary Vitals
- CVE-2026-25745OpenEMR's Message Update Ignores Patient id
- CVE-2026-32127SQL Injection Vulnerability in ajax graphs library (OpenEMR)
- CVE-2026-32126OpenEMR: Inverted ACL Condition in CDR ControllerRouter Allows Any Authenticated User to Modify/Delete Clinical Rules and Plans
- CVE-2026-32125OpenEMR: Stored XSS in Track Anything Graphs via Unescaped Dygraph Titles/Labels
- CVE-2026-32124OpenEMR: Dynamic Code Picker Renders Unescaped Descriptions (Stored XSS)
- CVE-2026-32123OpenEMR: Therapy Group Sensitivity ACL No Longer Enforced
- CVE-2026-32122OpenEMR: Missing Authorization on Claim File Tracker UI and AJAX Endpoint (V2)
- CVE-2026-32121OpenEMR: Stored DOM XSS via `.html()` in Portal Signer Modal
- CVE-2026-32118OpenEMR has Stored XSS in Graphical Pain Map legend via unescaped annotation text
- CVE-2026-24898OpenEMR has an Unauthenticated MedEx Token Disclosure
- CVE-2026-25146OpenEMR's payments gateway_api_key secret rendered into client JS code
- CVE-2026-24848OpenEMR Arbitrary File Write leading to Remote Code Execution
- CVE-2026-25147OpenEMR's Portal Payment Endpoint Trusts User-Controlled pid
- CVE-2026-24488OpenEMR Vulnerable to Arbitrary File Exfiltration via Fax Endpoint
- CVE-2026-27943OpenEMR's Eye Exam View Trusts form_id Without Verifying Patient/Encounter Ownership
- CVE-2026-25930OpenEMR's Printable LBF Endpoint Leaks Arbitrary Patient Forms