Show filters
7 Total Results
Displaying 1-7 of 7
Sort by:
Attacker Value
Unknown
CVE-2020-19364
Disclosure Date: January 20, 2021 (last updated February 22, 2025)
OpenEMR 5.0.1 allows an authenticated attacker to upload and execute malicious PHP scripts through /controller.php.
0
Attacker Value
Unknown
CVE-2018-16795
Disclosure Date: December 31, 2020 (last updated February 22, 2025)
OpenEMR 5.0.1.3 allows Cross-Site Request Forgery (CSRF) via library/ajax and interface/super, as demonstrated by use of interface/super/manage_site_files.php to upload a .php file.
0
Attacker Value
Unknown
CVE-2019-8368
Disclosure Date: September 16, 2019 (last updated November 27, 2024)
OpenEMR v5.0.1-6 allows XSS.
0
Attacker Value
Unknown
CVE-2019-8371
Disclosure Date: September 16, 2019 (last updated November 27, 2024)
OpenEMR v5.0.1-6 allows code execution.
0
Attacker Value
Unknown
CVE-2018-1000218
Disclosure Date: August 20, 2018 (last updated November 27, 2024)
OpenEMR version v5_0_1_4 contains a Cross Site Scripting (XSS) vulnerability in The 'file' parameter in line #43 of interface/fax/fax_view.php that can result in The vulnerability could allow remote authenticated attackers to inject arbitrary web script or HTML.. This attack appear to be exploitable via The victim must visit on a specially crafted URL..
0
Attacker Value
Unknown
CVE-2018-1000219
Disclosure Date: August 20, 2018 (last updated November 27, 2024)
OpenEMR version v5_0_1_4 contains a Cross Site Scripting (XSS) vulnerability in The 'scan' parameter in line #41 of interface/fax/fax_view.php that can result in The vulnerability could allow remote authenticated attackers to inject arbitrary web script or HTML.. This attack appear to be exploitable via The victim must visit on a specially crafted URL..
0
Attacker Value
Unknown
CVE-2017-6394
Disclosure Date: March 02, 2017 (last updated November 26, 2024)
Multiple Cross-Site Scripting (XSS) issues were discovered in OpenEMR 5.0.0 and 5.0.1-dev. The vulnerabilities exist due to insufficient filtration of user-supplied data passed to the "openemr-master/gacl/admin/object_search.php" URL (section_value; src_form). An attacker could execute arbitrary HTML and script code in a browser in the context of the vulnerable website.
0
