Priority HIGH 79
OpenEMR is a free and open source electronic health records and medical practice management application.
openemr
Records154All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical9CVSS 9.0–10.0
CVSS high69CVSS 7.0–8.9
Exploited now
openemr records in CISA KEVNo openemr vulnerabilities are listed in CISA KEV.
Components
Products in the NVD configurations · select one to filter the recordsRecords
154 records
Priority HIGH 76
OpenEMR is a free and open source electronic health records and medical practice management application.
TI-2026-28796 CVE-2026-39932 · GHSA-pj78-c8jq-8xhf
OpenEMR 8.2.0 Remote Code Execution via CategoryTree eval() Injection
Priority HIGH 76
OpenEMR through 8.2.0 contains a remote code execution vulnerability in the document category tree component (library/classes/Tree.class.php) that allows authenticated administrators to execute arbitrary operating system…
Priority HIGH 76
OpenEMR is a free and open source electronic health records and medical practice management application.
Priority HIGH 76
OpenEMR is a free and open source electronic health records and medical practice management application.
TI-2026-20048 CVE-2026-24849
OpenEMR Arbitrary File Read Vulnerability
Priority HIGH 76
OpenEMR is a free and open source electronic health records and medical practice management application.
TI-2020-10645 CVE-2020-13567 · GHSA-g82r-h8rh-vpp3
SQL injection in OpenEMR
Priority HIGH 76
Multiple SQL injection vulnerabilities exist in phpGACL 3.3.7.
Priority HIGH 74
OpenEMR is a free and open source electronic health records and medical practice management application.
Priority HIGH 74
OpenEMR is a free and open source electronic health records and medical practice management application.
TI-2023-02764 CVE-2023-2948 · GHSA-9942-rg4x-mcpv
Cross-site Scripting (XSS) - Generic in openemr/openemr
Priority HIGH 74
Cross-site Scripting (XSS) - Generic in GitHub repository openemr/openemr prior to 7.0.1.
TI-2026-82377 CVE-2026-49142 · GHSA-4x43-68v3-4x7c
SQL injection in OpenEMR Syndromic Surveillance module
Priority HIGH 73
OpenEMR before 8.5.0 contains an authenticated SQL injection vulnerability in the Syndromic Surveillance module that allows users with Clinician-level privileges to read and modify arbitrary database contents by submitti…
TI-2026-26275 CVE-2026-33917
OpenEMR has SQL Injection in CAMOS Form
Priority HIGH 73
OpenEMR is a free and open source electronic health records and medical practice management application.
Priority HIGH 73
OpenEMR is a free and open source electronic health records and medical practice management application.
TI-2026-25754 CVE-2026-33348
OpenEMR has Stored XSS in patient encounter Eye Exam form $CHRONIC2 and $CHRONIC3
Priority HIGH 73
OpenEMR is a free and open source electronic health records and medical practice management application.
Priority HIGH 73
OpenEMR is a free and open source electronic health records and medical practice management application.
TI-2026-20814 CVE-2026-25746
OpenEMR has SQL Injection Vulnerability
Priority HIGH 73
OpenEMR is a free and open source electronic health records and medical practice management application.
Priority HIGH 73
OpenEMR is a free and open source electronic health records and medical practice management application.
Priority HIGH 73
OpenEMR is a free and open source electronic health records and medical practice management application.
TI-2025-42685 CVE-2025-69231
OpenEMR has a Stored XSS in GAD-7 Form that Enables Session Hijacking and Privilege Escalation
Priority HIGH 73
OpenEMR is a free and open source electronic health records and medical practice management application.
Priority HIGH 73
OpenEMR is a free and open source electronic health records and medical practice management application.
TI-2026-47765 CVE-2026-67611 · GHSA-g6r6-jr7g-hg95
OpenEMR 8.2.0 OAuth2 Password Grant Authentication Bypass via SMART Configuration
Priority HIGH 72
OpenEMR through 8.2.0 contains an authentication bypass vulnerability that allows attackers with valid credentials to circumvent multi-factor authentication by exploiting the exposed OAuth2 password grant flow through an…
TI-2026-47764 CVE-2026-67610 · GHSA-7h45-2j8g-37rm
OpenEMR 8.2.0 OAuth2 Dynamic Client Registration Unauthorized FHIR Access
Priority HIGH 72
OpenEMR through 8.2.0 contains an improper authentication vulnerability in the OAuth2 dynamic client registration endpoint that allows unauthenticated attackers to register a malicious client with system-level FHIR scope…
TI-2026-28795 CVE-2026-39931 · GHSA-v687-rxcc-g864
OpenEMR Authenticated SQL Injection via backup.php Import Feature
Priority HIGH 72
OpenEMR through 8.2.0 contains an authenticated SQL injection vulnerability in the backup configuration import feature that allows administrators with admin or super ACL privileges to execute arbitrary DDL and DML statem…
TI-2026-24655 CVE-2026-32118
OpenEMR has Stored XSS in Graphical Pain Map legend via unescaped annotation text
Priority HIGH 72
OpenEMR is a free and open source electronic health records and medical practice management application.
Priority HIGH 72
OpenEMR is a free and open source electronic health records and medical practice management application.