| Package | Affected versions | Patched versions |
|---|---|---|
| openemr | = 6.0.0 |
An authenticated SQL injection issue in the calendar search function of OpenEMR 6.0.0 before patch 3 allows an attacker to read data from all tables of the database via the parameter provider_id, as demonstrated by the /interface/main/calendar/index.php?module=PostCalendar&func=search URI.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free