CVE search
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
| CVE-2019-16404 | 高危8.8 | Authenticated SQL Injection in interface/forms/eye_mag/js/eye_base.php in OpenEMR through 5.0.2 allows a user to extract arbitrary data from the openemr database via a non-parameterized INSERT INTO statement, as demonstrated by the providerID parameter. | 21/10/2019 |
| CVE-2019-17409 | 中危6.1 | Reflected XSS exists in interface/forms/eye_mag/view.php in OpenEMR 5.x before 5.0.2.1 ia the id parameter. | 21/10/2019 |
| CVE-2019-16862 | 中危6.1 | Reflected XSS in interface/forms/eye_mag/view.php in OpenEMR 5.x before 5.0.2.1 allows a remote attacker to execute arbitrary code in the context of a user's session via the pid parameter. | 21/10/2019 |
| CVE-2019-17197 | 严重9.8 | OpenEMR through 5.0.2 has SQL Injection in the Lifestyle demographic filter criteria in library/clinical_rules.php that affects library/patient.inc. | 05/10/2019 |
| CVE-2019-17179 | 中危6.1 | 4.1.0, 4.1.1, 4.1.2, 4.1.2.3, 4.1.2.6, 4.1.2.7, 4.2.0, 4.2.1, 4.2.2, 5.0.0, 5.0.0.5, 5.0.0.6, 5.0.1, 5.0.1.1, 5.0.1.2, 5.0.1.3, 5.0.1.4, 5.0.1.5, 5.0.1.6, 5.0.1.7, 5.0.2, fixed in version 5.0.2.1 | 04/10/2019 |
| CVE-2019-8368 | 中危6.1 | OpenEMR v5.0.1-6 allows XSS. | 16/09/2019 |
| CVE-2019-8371 | 高危7.2 | OpenEMR v5.0.1-6 allows code execution. | 16/09/2019 |
| CVE-2019-3968 | 高危8.8 | In OpenEMR 5.0.1 and earlier, an authenticated attacker can execute arbitrary commands on the host system via the Scanned Forms interface when creating a new form. | 20/08/2019 |
| CVE-2019-3967 | 中危6.5 | In OpenEMR 5.0.1 and earlier, the patient file download interface contains a directory traversal flaw that allows authenticated attackers to download arbitrary files from the host system. | 20/08/2019 |
| CVE-2019-3966 | 中危6.1 | In OpenEMR 5.0.1 and earlier, controller.php contains a reflected XSS vulnerability in the foreign_id parameter. This could allow an attacker to execute arbitrary code in the context of a user's session. | 20/08/2019 |
| CVE-2019-3965 | 中危6.1 | In OpenEMR 5.0.1 and earlier, controller.php contains a reflected XSS vulnerability in the document_id parameter. This could allow an attacker to execute arbitrary code in the context of a user's session. | 20/08/2019 |
| CVE-2019-3964 | 中危6.1 | In OpenEMR 5.0.1 and earlier, controller.php contains a reflected XSS vulnerability in the doc_id parameter. This could allow an attacker to execute arbitrary code in the context of a user's session. | 20/08/2019 |
| CVE-2019-3963 | 中危6.1 | In OpenEMR 5.0.1 and earlier, controller.php contains a reflected XSS vulnerability in the patient_id parameter. This could allow an attacker to execute arbitrary code in the context of a user's session. | 20/08/2019 |
| CVE-2019-14530 | 高危8.8 | An issue was discovered in custom/ajax_download.php in OpenEMR before 5.0.2 via the fileName parameter. An attacker can download any file (that is readable by the user www-data) from server storage. If the requested file is writable for the www-data user and the directory /var/www/openemr/sites/default/documents/cqm_qr | 13/08/2019 |
| CVE-2019-14529 | 严重9.8 | OpenEMR before 5.0.2 allows SQL Injection in interface/forms/eye_mag/save.php. | 02/08/2019 |
| CVE-2018-17181 | 严重9.8 | An issue was discovered in OpenEMR before 5.0.1 Patch 7. SQL Injection exists in the SaveAudit function in /portal/lib/paylib.php and the portalAudit function in /portal/lib/appsql.class.php. | 17/05/2019 |
| CVE-2018-17180 | 中危5.3 | An issue was discovered in OpenEMR before 5.0.1 Patch 7. Directory Traversal exists via docid=../ to /portal/lib/download_template.php. | 17/05/2019 |