| CVE-2026-124552 | TRUNG BÌNH4.8 | Webmin through 2.670 contains a stored cross-site scripting vulnerability in the Shorewall and Shorewall6 modules' list.cgi, which renders table fields and COMMENT lines unescaped. Authenticated users with table edit permission can store JavaScript via savecmt.cgi or table entries that executes when other users, includ | 08/11/2026 |
| CVE-2026-124551 | TRUNG BÌNH5.3 | ClassroomIO through 1.0.0 contains an authorization bypass vulnerability that allows authenticated users of any organization to clone other tenants' courses via the POST /course/:courseId/clone endpoint. Attackers who know a target course id can copy its sections, lessons, exercises, and quiz answer keys into their own | 08/11/2026 |
| CVE-2026-124494 | NGHIÊM TRỌNG9.3 | SunEditor before 3.4.0 contains a stored cross-site scripting vulnerability because the html.clean() sanitizer's _normalizeURL() function decodes named entities like : to an empty string. Attackers can inject href values such as javascript: that pass the _isSafeURL() check but are decoded by browsers, execu | 08/11/2026 |
| CVE-2026-124493 | NGHIÊM TRỌNG9.3 | SunEditor before 3.4.0 contains a stored cross-site scripting vulnerability in the DocumentType constructor that injects header textContent into innerHTML without HTML escaping. Attackers can store entity-encoded HTML in h1-h6 headers that executes JavaScript when editors using document:header mode initialize, enabling | 08/11/2026 |
| CVE-2026-124492 | CAO7.6 | SunEditor before 3.4.0 contains a stored cross-site scripting vulnerability in ModalAnchorEditor's #createBookmarkList, which inserts entity-decoded h1-h6 header textContent into the bookmark list via innerHTML without escaping. Attackers can store HTML-encoded payloads in editor headers that execute JavaScript when a | 08/11/2026 |
| CVE-2026-124491 | TRUNG BÌNH6.4 | SunEditor before 3.4.0 contains a stored cross-site scripting vulnerability in the FileUpload plugin create() method that assigns server-returned file names to innerHTML without escaping. Attackers can upload files with HTML-laden names that bypass html.clean() and execute JavaScript in victims' browsers when content o | 08/11/2026 |
| CVE-2026-124490 | NGHIÊM TRỌNG9.1 | OpenEMR before 8.3.0 contains a path traversal vulnerability in the RingCentral RCFaxClient disposeDocument() method of oe-module-faxsms that allows authenticated attackers to read and write arbitrary files via the file_path parameter. Attackers can use action=download to read credentials and source code, or action=set | 08/11/2026 |
| CVE-2026-124489 | CAO7.1 | OpenEMR before 8.3.0 contains a broken access control vulnerability in portal/portal_payment.php that allows low-privilege authenticated users to bypass billing ACL checks by tampering patient identifiers. Attackers can modify the pid and form_pid parameters to view payment pages and record fraudulent payment receipts | 08/11/2026 |
| CVE-2026-124488 | CAO8.1 | OpenEMR before 8.3.0 contains an authorization bypass vulnerability that allows authenticated clinicians lacking high-sensitivity permission to read and modify encounter-bound forms via load_form.php. Attackers can request the Clinical Notes or Care Plan direct loader to obtain restricted content and a CSRF token, then | 08/11/2026 |
| CVE-2026-124487 | TRUNG BÌNH6.5 | OpenEMR before 8.4.0 contains an improper authorization vulnerability in the non-patient POST /fhir/DocumentReference/$docref route that allows low-privileged users to generate any patient's CCDA. Attackers with only demographics and documents permissions can supply a victim patient parameter, then download the full-ch | 08/11/2026 |
| CVE-2026-124486 | CAO8.8 | OpenEMR before 8.3.0 contains a missing authorization vulnerability in the classic document controller that allows low-privilege authenticated users to recategorize other patients' documents. Attackers can invoke move_action_process to move a document into a patients|demo category, then retrieve it with an empty patien | 08/11/2026 |
| CVE-2026-124485 | TRUNG BÌNH6.5 | OpenEMR before 8.3.0 contains an authorization bypass vulnerability in the patient portal onsitedocuments API that allows authenticated patients to read other patients' documents by overriding query criteria. Attackers can send empty pid_Equals and denialReason_IsNotLike parameters to remove patient scoping and locked | 08/11/2026 |
| CVE-2026-124484 | CAO8.8 | OpenEMR before 8.4.0 contains a missing authorization vulnerability in portal onsite-document APIs that allows any authenticated core user to access cross-patient documents. Attackers can omit the patientId parameter and supply arbitrary record IDs to list, read, and overwrite other patients' portal documents, signatur | 08/11/2026 |
| CVE-2026-124483 | CAO8.3 | OpenEMR before 8.4.0 contains an incorrect authorization vulnerability because the prescription REST API routes check the patients.med ACL instead of patients.rx and request no specific permission bit, so read-only Medical/History access passes the check. Authenticated staff users can reuse the UI-exposed APICSRFTOKEN | 08/11/2026 |
| CVE-2026-124482 | TRUNG BÌNH6.5 | OpenEMR before 8.4.0 contains an authorization bypass allowing low-privileged SMART standalone-launch users to bind arbitrary patient UUIDs into the OAuth token context. Attackers with only the patients|demo ACL can select a victim during authorization and read that patient's clinical notes and documents through patien | 08/11/2026 |
| CVE-2026-124481 | TRUNG BÌNH6.5 | OpenEMR before 8.4.0 contains an improper authorization vulnerability in Rainforest patient portal payments that trusts browser-supplied patientId, encounter, and amount values instead of deriving them from the portal session. Authenticated portal patients can tamper with JSON sent to portal_payment.rainforest.php so t | 08/11/2026 |
| CVE-2026-124480 | CAO8.8 | OpenEMR before 8.4.0 contains an authorization bypass vulnerability that allows low-privileged authenticated users to read cross-patient FHIR QuestionnaireResponse data by sending the APICSRFTOKEN header. Attackers can reuse the session-exposed api_csrf_token_js value to skip FHIR scope checks and call GET /fhir/Questi | 08/11/2026 |
| CVE-2026-124479 | TRUNG BÌNH6.5 | OpenEMR before 8.4.0 contains an arbitrary local file read vulnerability in REST document download, where the controller passes stored uploaded document bytes to Symfony's BinaryFileResponse as a filesystem path instead of returning them as content. Authenticated users with document upload and download access can uploa | 08/11/2026 |
| CVE-2026-124478 | TRUNG BÌNH6.5 | OpenEMR before 8.3.0 contains a missing authorization vulnerability in the addRecall action of /interface/main/messages/save.php that allows low-privileged authenticated users to modify arbitrary patients' recall data. Attackers can submit a crafted new_pid with recall, contact, provider, facility, and notification pre | 08/11/2026 |
| CVE-2026-124477 | CAO8.8 | OpenEMR before 8.3.0 contains a missing authorization vulnerability that allows low-privileged authenticated users to delete arbitrary patient recall records via the delete_Recall action. Attackers can send POST requests to /interface/main/messages/save.php with a target pid and r_ID to remove recall data without ACL o | 08/11/2026 |