Open-emr vulnerabilities

By year

Bars are flaws published each year; the red part is the share attackers have used.

Latest high and critical flaws

• CVE-2023-54347 OpenEMR 7.0.1 contains an authentication brute force vulnerability that allows attackers to bypass rate limiting protections by sending repeated login attempts High 8.7 · May 5, 2026
• CVE-2024-22611 OpenEMR 7.0.2 is vulnerable to SQL Injection via \openemr\library\classes\Pharmacy.class.php, \controllers\C_Pharmacy.class.php and \openemr\controller.php.Critical 9.8 · Apr 3, 2025
• CVE-2023-22974 A Path Traversal in setup.php in OpenEMR < 7.0.0 allows remote unauthenticated users to read arbitrary files by controlling a connection to an attacker-controllHigh 7.5 · Feb 22, 2023
• CVE-2023-22973 A Local File Inclusion (LFI) vulnerability in interface/forms/LBF/new.php in OpenEMR < 7.0.0 allows remote authenticated users to execute code via the formname High 8.8 · Feb 22, 2023
• CVE-2022-25471 An Insecure Direct Object Reference (IDOR) vulnerability in OpenEMR 6.0.0 allows any authenticated attacker to access and modify unauthorized areas via a crafteHigh 8.1 · Mar 2, 2022
• CVE-2021-25923 In OpenEMR, versions 5.0.0 to 6.0.0.1 are vulnerable to weak password requirements as it does not enforce a maximum password length limit.High 8.1 · Jun 24, 2021
• CVE-2021-32104 A SQL injection vulnerability exists (with user privileges) in interface/forms/eye_mag/save.php in OpenEMR 5.0.2.1.High 8.8 · May 7, 2021
• CVE-2021-32102 A SQL injection vulnerability exists (with user privileges) in library/custom_template/ajax_code.php in OpenEMR 5.0.2.1.High 8.8 · May 7, 2021
• CVE-2021-32101 The Patient Portal of OpenEMR 5.0.2.1 is affected by a incorrect access control system in portal/patient/_machine_config.php.High 8.2 · May 7, 2021
• CVE-2020-13568 SQL injection vulnerability exists in phpGACL 3.3.7.High 8.8 · Apr 13, 2021
• CVE-2020-13566 SQL injection vulnerabilities exist in phpGACL 3.3.7.High 8.8 · Apr 13, 2021
• CVE-2020-29143 A SQL injection vulnerability in interface/reports/non_reported.php in OpenEMR before 5.0.2.5 allows a remote authenticated attacker to execute arbitrary SQL coHigh 7.2 · Feb 15, 2021
• CVE-2020-29140 A SQL injection vulnerability in interface/reports/immunization_report.php in OpenEMR before 5.0.2.5 allows a remote authenticated attacker to execute arbitraryHigh 7.2 · Feb 15, 2021
• CVE-2020-29139 A SQL injection vulnerability in interface/main/finder/patient_select.php from library/patient.inc in OpenEMR before 5.0.2.5 allows a remote authenticated attacHigh 7.2 · Feb 15, 2021
• CVE-2020-29142 A SQL injection vulnerability in interface/usergroup/usergroup_admin.php in OpenEMR before 5.0.2.5 allows a remote authenticated attacker to execute arbitrary SHigh 7.2 · Feb 15, 2021
• CVE-2020-36243 The Patient Portal of OpenEMR 5.0.2.1 is affected by a Command Injection vulnerability in /interface/main/backup.php.High 8.8 · Feb 7, 2021
• CVE-2020-13569 A cross-site request forgery vulnerability exists in the GACL functionality of OpenEMR 5.0.2 and development version 6.0.0 (commit babec93f600ff1394f91ccd512bcaHigh 8.8 · Jan 28, 2021
• CVE-2020-19364 OpenEMR 5.0.1 allows an authenticated attacker to upload and execute malicious PHP scripts through /controller.php.High 8.8 · Jan 19, 2021
• CVE-2018-16795 OpenEMR 5.0.1.3 allows Cross-Site Request Forgery (CSRF) via library/ajax and interface/super, as demonstrated by use of interface/super/manage_site_files.php tHigh 8.8 · Dec 30, 2020
• CVE-2019-16404 Authenticated SQL Injection in interface/forms/eye_mag/js/eye_base.php in OpenEMR through 5.0.2 allows a user to extract arbitrary data from the openemr databasHigh 8.8 · Oct 21, 2019
• CVE-2019-17197 OpenEMR through 5.0.2 has SQL Injection in the Lifestyle demographic filter criteria in library/clinical_rules.php that affects library/patient.inc.Critical 9.8 · Oct 5, 2019
• CVE-2019-8371 OpenEMR v5.0.1-6 allows code execution.High 7.2 · Sep 16, 2019
• CVE-2019-3968 In OpenEMR 5.0.1 and earlier, an authenticated attacker can execute arbitrary commands on the host system via the Scanned Forms interface when creating a new foHigh 8.8 · Aug 20, 2019
• CVE-2019-14530 An issue was discovered in custom/ajax_download.php in OpenEMR before 5.0.2 via the fileName parameter.High 8.8 · Aug 13, 2019
• CVE-2019-14529 OpenEMR before 5.0.2 allows SQL Injection in interface/forms/eye_mag/save.php.Critical 9.8 · Aug 2, 2019