Read the docs

Open-Emr

Records221All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical17CVSS 9.0–10.0
CVSS high101CVSS 7.0–8.9

Exploited now

Open-Emr records in CISA KEV

No Open-Emr vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records
Openemr 221 records HIGH

Records

221 records in Openemr · all components

TI-2024-15079 CVE-2024-22611 · GHSA-xmgg-6wgj-628j

OpenEMR 7.0.2 is vulnerable to SQL Injection via…

Priority HIGH 82

OpenEMR 7.0.2 is vulnerable to SQL Injection via \openemr\library\classes\Pharmacy.class.php, \controllers\C_Pharmacy.class.php and \openemr\controller.php.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.06315 Published 2025-04-03 No fix listed CWE-89
TI-2013-06186 CVE-2013-10044 · GHSA-gfgm-2frc-x4f5

OpenEMR ≤ 4.1.1 SQL Injection Privilege Escalation and RCE

Priority HIGH 79

An authenticated SQL injection vulnerability exists in OpenEMR ≤ 4.1.1 Patch 14 that allows a low-privileged attacker to extract administrator credentials and subsequently escalate privileges.

CVSS 4.0HIGH 8.7 Network Low privileges No interaction EPSS 0.0229 Published 2025-08-01 No fix listed CWE-434
TI-2023-30621 CVE-2023-54347 · GHSA-78v5-jfg9-88wq

OpenEMR 7.0.1 Authentication Brute Force Mitigation Bypass

Priority HIGH 77

OpenEMR 7.0.1 contains an authentication brute force vulnerability that allows attackers to bypass rate limiting protections by sending repeated login attempts to the main login endpoint.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00537 Published 2026-05-05 No fix listed CWE-307
TI-2026-28796 CVE-2026-39932 · GHSA-pj78-c8jq-8xhf

OpenEMR 8.2.0 Remote Code Execution via CategoryTree eval() Injection

Priority HIGH 76

OpenEMR through 8.2.0 contains a remote code execution vulnerability in the document category tree component (library/classes/Tree.class.php) that allows authenticated administrators to execute arbitrary operating system…

CVSS 4.0CRITICAL 9.4 Network High privileges No interaction EPSS 0.02002 Published 2026-08-03 No fix listed CWE-95
TI-2026-20048 CVE-2026-24849

OpenEMR Arbitrary File Read Vulnerability

Priority HIGH 76

OpenEMR is a free and open source electronic health records and medical practice management application.

CVSS 3.1CRITICAL 10.0 Network Low privileges No interaction EPSS 0.02174 Published 2026-02-25 Fixed in 7.0.4 CWE-22
TI-2020-10645 CVE-2020-13567 · GHSA-g82r-h8rh-vpp3

SQL injection in OpenEMR

Priority HIGH 76

Multiple SQL injection vulnerabilities exist in phpGACL 3.3.7.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.02345 Published 2022-04-18 No fix listed CWE-89
TI-2026-26275 CVE-2026-33917

OpenEMR has SQL Injection in CAMOS Form

Priority HIGH 73

OpenEMR is a free and open source electronic health records and medical practice management application.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00453 Published 2026-03-25 Fixed in 8.0.0.3 CWE-89
TI-2026-20814 CVE-2026-25746

OpenEMR has SQL Injection Vulnerability

Priority HIGH 73

OpenEMR is a free and open source electronic health records and medical practice management application.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.03524 Published 2026-02-25 Fixed in 8.0.0 CWE-89
Load more
Open these records in search →