Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
231 results · page 3 of 5
May 28, 2023Improper Authorization in GitHub repository openemr/openemr prior to 7.0.1.CVE-2023-2950 · Other software · openemr · reported by security@huntr.devHigh 8.1
Improper Authorization in GitHub repository openemr/openemr prior to 7.0.1.
- Product
- openemr/openemr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 28, 2023Cross-site Scripting (XSS) - Reflected in GitHub repository openemr/openemr prior to 7.0.1.CVE-2023-2949 · Other software · openemr · reported by security@huntr.devMedium 6.1
Cross-site Scripting (XSS) - Reflected in GitHub repository openemr/openemr prior to 7.0.1.
- Product
- openemr/openemr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 28, 2023Cross-site Scripting (XSS) - Generic in GitHub repository openemr/openemr prior to 7.0.1.CVE-2023-2948 · Other software · openemr · reported by security@huntr.devMedium 6.1
Cross-site Scripting (XSS) - Generic in GitHub repository openemr/openemr prior to 7.0.1.
- Product
- openemr/openemr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 27, 2023Cross-site Scripting (XSS) - Stored in GitHub repository openemr/openemr prior to 7.0.1.CVE-2023-2947 · Other software · openemr · reported by security@huntr.devMedium 4.8
Cross-site Scripting (XSS) - Stored in GitHub repository openemr/openemr prior to 7.0.1.
- Product
- openemr/openemr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 27, 2023Improper Access Control in GitHub repository openemr/openemr prior to 7.0.1.CVE-2023-2946 · Other software · openemr · reported by security@huntr.devHigh 8.1
Improper Access Control in GitHub repository openemr/openemr prior to 7.0.1.
- Product
- openemr/openemr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 27, 2023Missing Authorization in GitHub repository openemr/openemr prior to 7.0.1.CVE-2023-2945 · Other software · openemr · reported by security@huntr.devMedium 5.4
Missing Authorization in GitHub repository openemr/openemr prior to 7.0.1.
- Product
- openemr/openemr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 27, 2023Improper Access Control in GitHub repository openemr/openemr prior to 7.0.1.CVE-2023-2944 · Other software · openemr · reported by security@huntr.devMedium 5.4
Improper Access Control in GitHub repository openemr/openemr prior to 7.0.1.
- Product
- openemr/openemr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 27, 2023Code Injection in GitHub repository openemr/openemr prior to 7.0.1.CVE-2023-2943 · Other software · openemr · reported by security@huntr.devHigh 8.8
Code Injection in GitHub repository openemr/openemr prior to 7.0.1.
- Product
- openemr/openemr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 27, 2023Improper Input Validation in GitHub repository openemr/openemr prior to 7.0.1.CVE-2023-2942 · Other software · openemr · reported by security@huntr.devHigh 8.1
Improper Input Validation in GitHub repository openemr/openemr prior to 7.0.1.
- Product
- openemr/openemr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 12, 2023Improper Access Control in GitHub repository openemr/openemr prior to 7.0.1.CVE-2023-2674 · Other software · openemr · reported by security@huntr.devMedium 4.3
Improper Access Control in GitHub repository openemr/openemr prior to 7.0.1.
- Product
- openemr/openemr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 8, 2023Cross-site Scripting (XSS) - Stored in GitHub repository openemr/openemr prior to 7.0.1.CVE-2023-2566 · Other software · openemr · reported by security@huntr.devMedium 4.8
Cross-site Scripting (XSS) - Stored in GitHub repository openemr/openemr prior to 7.0.1.
- Product
- openemr/openemr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 22, 2023A Path Traversal in setup.php in OpenEMR < 7.0.0 allows remote unauthenticated users to read arbitrary files by controlling a connection to an attacker-controllCVE-2023-22974 · Other software · Open-emr · reported by MITREHigh 7.5
A Path Traversal in setup.php in OpenEMR < 7.0.0 allows remote unauthenticated users to read arbitrary files by controlling a connection to an attacker-controlled MySQL server.
- Product
- Openemr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopen-emr.orgsonarsource.com
Feb 22, 2023A Local File Inclusion (LFI) vulnerability in interface/forms/LBF/new.php in OpenEMR < 7.0.0 allows remote authenticated users to execute code via the formname CVE-2023-22973 · Other software · Open-emr · reported by MITREHigh 8.8
A Local File Inclusion (LFI) vulnerability in interface/forms/LBF/new.php in OpenEMR < 7.0.0 allows remote authenticated users to execute code via the formname parameter.
- Product
- Openemr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopen-emr.orgsonarsource.com
Feb 22, 2023A Reflected Cross-site scripting (XSS) vulnerability in interface/forms/eye_mag/php/eye_mag_functions.php in OpenEMR < 7.0.0 allows remote authenticated users tCVE-2023-22972 · Other software · Open-emr · reported by MITREMedium 5.4
A Reflected Cross-site scripting (XSS) vulnerability in interface/forms/eye_mag/php/eye_mag_functions.php in OpenEMR < 7.0.0 allows remote authenticated users to inject arbitrary web script or HTML via the REQUEST_URI.
- Product
- Openemr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopen-emr.orgopen-emr.org
Dec 27, 2022Cross-site Scripting (XSS) - Stored in GitHub repository openemr/openemr prior to 7.0.0.2.CVE-2022-4733 · Other software · openemr · reported by security@huntr.devMedium 4.8
Cross-site Scripting (XSS) - Stored in GitHub repository openemr/openemr prior to 7.0.0.2.
- Product
- openemr/openemr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 19, 2022Cross-site Scripting (XSS) - Reflected in GitHub repository openemr/openemr prior to 7.0.0.2.CVE-2022-4615 · Other software · openemr · reported by security@huntr.devMedium 6.1
Cross-site Scripting (XSS) - Reflected in GitHub repository openemr/openemr prior to 7.0.0.2.
- Product
- openemr/openemr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 17, 2022Improper Access Control in GitHub repository openemr/openemr prior to 7.0.0.2.CVE-2022-4567 · Other software · openemr · reported by security@huntr.devHigh 8.1
Improper Access Control in GitHub repository openemr/openemr prior to 7.0.0.2.
- Product
- openemr/openemr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 14, 2022Unrestricted Upload of File with Dangerous Type in GitHub repository openemr/openemr prior to 7.0.0.2.CVE-2022-4506 · Other software · openemr · reported by security@huntr.devHigh 8.8
Unrestricted Upload of File with Dangerous Type in GitHub repository openemr/openemr prior to 7.0.0.2.
- Product
- openemr/openemr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 14, 2022Authorization Bypass Through User-Controlled Key in GitHub repository openemr/openemr prior to 7.0.0.2.CVE-2022-4505 · Other software · openemr · reported by security@huntr.devHigh 8.8
Authorization Bypass Through User-Controlled Key in GitHub repository openemr/openemr prior to 7.0.0.2.
- Product
- openemr/openemr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 14, 2022Improper Input Validation in GitHub repository openemr/openemr prior to 7.0.0.2.CVE-2022-4504 · Other software · openemr · reported by security@huntr.devHigh 7.5
Improper Input Validation in GitHub repository openemr/openemr prior to 7.0.0.2.
- Product
- openemr/openemr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 14, 2022Cross-site Scripting (XSS) - Generic in GitHub repository openemr/openemr prior to 7.0.0.2.CVE-2022-4503 · Other software · openemr · reported by security@huntr.devMedium 6.1
Cross-site Scripting (XSS) - Generic in GitHub repository openemr/openemr prior to 7.0.0.2.
- Product
- openemr/openemr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 14, 2022Cross-site Scripting (XSS) - Reflected in GitHub repository openemr/openemr prior to 7.0.0.2.CVE-2022-4502 · Other software · openemr · reported by security@huntr.devMedium 6.1
Cross-site Scripting (XSS) - Reflected in GitHub repository openemr/openemr prior to 7.0.0.2.
- Product
- openemr/openemr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 15, 2022Authorization Bypass Through User-Controlled Key in GitHub repository openemr/openemr prior to 7.0.0.1.CVE-2022-2824 · Other software · openemr · reported by security@huntr.devHigh 8.8
Authorization Bypass Through User-Controlled Key in GitHub repository openemr/openemr prior to 7.0.0.1.
- Product
- openemr/openemr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 9, 2022Improper Restriction of Rendered UI Layers or Frames in GitHub repository openemr/openemr prior to 7.0.0.1.CVE-2022-2734 · Other software · openemr · reported by security@huntr.devMedium 5.4
Improper Restriction of Rendered UI Layers or Frames in GitHub repository openemr/openemr prior to 7.0.0.1.
- Product
- openemr/openemr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 9, 2022Cross-site Scripting (XSS) - Reflected in GitHub repository openemr/openemr prior to 7.0.0.1.CVE-2022-2733 · Other software · openemr · reported by security@huntr.devMedium 6.1
Cross-site Scripting (XSS) - Reflected in GitHub repository openemr/openemr prior to 7.0.0.1.
- Product
- openemr/openemr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 9, 2022Missing Authorization in GitHub repository openemr/openemr prior to 7.0.0.1.CVE-2022-2732 · Other software · openemr · reported by security@huntr.devHigh 8.3
Missing Authorization in GitHub repository openemr/openemr prior to 7.0.0.1.
- Product
- openemr/openemr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 9, 2022Cross-site Scripting (XSS) - Reflected in GitHub repository openemr/openemr prior to 7.0.0.1.CVE-2022-2731 · Other software · openemr · reported by security@huntr.devMedium 6.1
Cross-site Scripting (XSS) - Reflected in GitHub repository openemr/openemr prior to 7.0.0.1.
- Product
- openemr/openemr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 9, 2022Authorization Bypass Through User-Controlled Key in GitHub repository openemr/openemr prior to 7.0.0.1.CVE-2022-2730 · Other software · openemr · reported by security@huntr.devMedium 6.5
Authorization Bypass Through User-Controlled Key in GitHub repository openemr/openemr prior to 7.0.0.1.
- Product
- openemr/openemr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 9, 2022Cross-site Scripting (XSS) - DOM in GitHub repository openemr/openemr prior to 7.0.0.1.CVE-2022-2729 · Other software · openemr · reported by security@huntr.devMedium 5.4
Cross-site Scripting (XSS) - DOM in GitHub repository openemr/openemr prior to 7.0.0.1.
- Product
- openemr/openemr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 22, 2022Cross-site Scripting (XSS) - Stored in GitHub repository openemr/openemr prior to 7.0.0.CVE-2022-2494 · Other software · openemr · reported by security@huntr.devMedium 5.4
Cross-site Scripting (XSS) - Stored in GitHub repository openemr/openemr prior to 7.0.0.
- Product
- openemr/openemr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 22, 2022Data Access from Outside Expected Data Manager Component in GitHub repository openemr/openemr prior to 7.0.0.CVE-2022-2493 · Other software · openemr · reported by security@huntr.devHigh 8.1
Data Access from Outside Expected Data Manager Component in GitHub repository openemr/openemr prior to 7.0.0.
- Product
- openemr/openemr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 25, 2022Non Privilege User can Enable or Disable Registered in GitHub repository openemr/openemr prior to 6.1.0.1.CVE-2022-1461 · Other software · openemr · reported by security@huntr.devMedium 6.5
Non Privilege User can Enable or Disable Registered in GitHub repository openemr/openemr prior to 6.1.0.1.
- Product
- openemr/openemr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 25, 2022Non-Privilege User Can View Patient’s Disclosures in GitHub repository openemr/openemr prior to 6.1.0.1.CVE-2022-1459 · Other software · openemr · reported by security@huntr.devHigh 8.3
Non-Privilege User Can View Patient’s Disclosures in GitHub repository openemr/openemr prior to 6.1.0.1.
- Product
- openemr/openemr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 25, 2022Stored XSS Leads To Session Hijacking in GitHub repository openemr/openemr prior to 6.1.0.1.CVE-2022-1458 · Other software · openemr · reported by security@huntr.devMedium 5.4
Stored XSS Leads To Session Hijacking in GitHub repository openemr/openemr prior to 6.1.0.1.
- Product
- openemr/openemr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 18, 2022Multiple SQL injection vulnerabilities exist in phpGACL 3.3.7.CVE-2020-13567 · Other software · OpenEMR · reported by talos-cna@cisco.comCritical 9.8
Multiple SQL injection vulnerabilities exist in phpGACL 3.3.7. A specially crafted HTTP request can lead to a SQL injection. An attacker can send an HTTP request to trigger this vulnerability.
- Product
- OpenEMR
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtalosintelligence.comtalosintelligence.com
Mar 30, 2022Stored Cross Site Scripting in GitHub repository openemr/openemr prior to 6.0.0.2.CVE-2022-1181 · Other software · openemr · reported by security@huntr.devMedium 5.4
Stored Cross Site Scripting in GitHub repository openemr/openemr prior to 6.0.0.2.
- Product
- openemr/openemr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 30, 2022Reflected Cross Site Scripting in GitHub repository openemr/openemr prior to 6.0.0.4.CVE-2022-1180 · Other software · openemr · reported by security@huntr.devLow 3.5
Reflected Cross Site Scripting in GitHub repository openemr/openemr prior to 6.0.0.4.
- Product
- openemr/openemr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 30, 2022Non-Privilege User Can Created New Rule and Lead to Stored Cross Site Scripting in GitHub repository openemr/openemr prior to 6.0.0.4.CVE-2022-1179 · Other software · openemr · reported by security@huntr.devMedium 5.4
Non-Privilege User Can Created New Rule and Lead to Stored Cross Site Scripting in GitHub repository openemr/openemr prior to 6.0.0.4.
- Product
- openemr/openemr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 30, 2022Stored Cross Site Scripting in GitHub repository openemr/openemr prior to 6.0.0.4.CVE-2022-1178 · Other software · openemr · reported by security@huntr.devMedium 5.4
Stored Cross Site Scripting in GitHub repository openemr/openemr prior to 6.0.0.4.
- Product
- openemr/openemr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 30, 2022Accounting User Can Download Patient Reports in openemr in GitHub repository openemr/openemr prior to 6.1.0.CVE-2022-1177 · Other software · openemr · reported by security@huntr.devMedium 4.3
Accounting User Can Download Patient Reports in openemr in GitHub repository openemr/openemr prior to 6.1.0.
- Product
- openemr/openemr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 25, 2022A stored cross-site scripting (XSS) issue was discovered in the OpenEMR Hospital Information Management System version 6.0.0.CVE-2022-24643 · Other software · Open-emr · reported by MITREMedium 5.4
A stored cross-site scripting (XSS) issue was discovered in the OpenEMR Hospital Information Management System version 6.0.0.
- Product
- Openemr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comsecurityforeveryone.com
Mar 23, 2022OpenEMR v6.0.0 was discovered to contain an incorrect access control issue.CVE-2022-25041 · Other software · Open-emr · reported by MITREMedium 4.3
OpenEMR v6.0.0 was discovered to contain an incorrect access control issue.
- Product
- Openemr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comsecurityforeveryone.com
Mar 2, 2022An Insecure Direct Object Reference (IDOR) vulnerability in OpenEMR 6.0.0 allows any authenticated attacker to access and modify unauthorized areas via a crafteCVE-2022-25471 · Other software · Open-emr · reported by MITREHigh 8.1
An Insecure Direct Object Reference (IDOR) vulnerability in OpenEMR 6.0.0 allows any authenticated attacker to access and modify unauthorized areas via a crafted POST request to /modules/zend_modules/public/Installer/register.
- Product
- Openemr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comsecurityforeveryone.com
Dec 16, 2021An authenticated SQL injection issue in the calendar search function of OpenEMR 6.0.0 before patch 3 allows an attacker to read data from all tables of the dataCVE-2021-41843 · Other software · Open-emr · reported by MITREMedium 6.5
An authenticated SQL injection issue in the calendar search function of OpenEMR 6.0.0 before patch 3 allows an attacker to read data from all tables of the database via the parameter provider_id, as demonstrated by the /interface/main/calendar/index.php?module=PostCalendar&func=search URI.
- Product
- Openemr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comseclists.org
Sep 1, 2021OpenEMR 6.0.0 has a pnotes_print.php?noteid= Insecure Direct Object Reference vulnerability via which an attacker can read the messages of all users.CVE-2021-40352 · Other software · Open-emr · reported by MITREMedium 6.5
OpenEMR 6.0.0 has a pnotes_print.php?noteid= Insecure Direct Object Reference vulnerability via which an attacker can read the messages of all users.
- Product
- Openemr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comgithub.com
Jun 24, 2021In OpenEMR, versions 5.0.0 to 6.0.0.1 are vulnerable to weak password requirements as it does not enforce a maximum password length limit.CVE-2021-25923 · Other software · Open-emr · reported by vulnerabilitylab@mend.ioHigh 8.1
In OpenEMR, versions 5.0.0 to 6.0.0.1 are vulnerable to weak password requirements as it does not enforce a maximum password length limit. If a malicious user is aware of the first 72 characters of the victim user’s password, he can leverage it to an account takeover.
- Product
- Openemr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comwhitesourcesoftware.com
May 7, 2021A SQL injection vulnerability exists (with user privileges) in interface/forms/eye_mag/save.php in OpenEMR 5.0.2.1.CVE-2021-32104 · Other software · Open-emr · reported by MITREHigh 8.8
A SQL injection vulnerability exists (with user privileges) in interface/forms/eye_mag/save.php in OpenEMR 5.0.2.1.
- Product
- Openemr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.sonarsource.comcommunity.open-emr.org
May 7, 2021A Stored XSS vulnerability in interface/usergroup/usergroup_admin.php in OpenEMR before 5.0.2.1 allows a admin authenticated user to inject arbitrary web scriptCVE-2021-32103 · Other software · Open-emr · reported by MITREMedium 4.8
A Stored XSS vulnerability in interface/usergroup/usergroup_admin.php in OpenEMR before 5.0.2.1 allows a admin authenticated user to inject arbitrary web script or HTML via the lname parameter.
- Product
- Openemr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.sonarsource.comcommunity.open-emr.org
May 7, 2021A SQL injection vulnerability exists (with user privileges) in library/custom_template/ajax_code.php in OpenEMR 5.0.2.1.CVE-2021-32102 · Other software · Open-emr · reported by MITREHigh 8.8
A SQL injection vulnerability exists (with user privileges) in library/custom_template/ajax_code.php in OpenEMR 5.0.2.1.
- Product
- Openemr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.sonarsource.comcommunity.open-emr.org
May 7, 2021The Patient Portal of OpenEMR 5.0.2.1 is affected by a incorrect access control system in portal/patient/_machine_config.php.CVE-2021-32101 · Other software · Open-emr · reported by MITREHigh 8.2
The Patient Portal of OpenEMR 5.0.2.1 is affected by a incorrect access control system in portal/patient/_machine_config.php. To exploit the vulnerability, an unauthenticated attacker can register an account, bypassing the permission check of this portal's API. Then, the attacker can then manipulate and read data of every registered patient.
- Product
- Openemr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.sonarsource.comcommunity.open-emr.org
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.