Vulnerabilities in openemr

126 results
Vexday analysis

O OpenEMR acumula 120 CVEs catalogadas, com 7 classificadas como críticas e nenhuma confirmada em exploração ativa no catálogo CISA KEV, taxa abaixo da média geral do catálogo. Apesar da ausência de exploração ativa confirmada, o cenário merece atenção: CVE-2023-2948 apresenta score EPSS de 0,9673, indicando probabilidade muito elevada de exploração nos próximos 30 dias e devendo ser tratada como prioridade imediata de remediação. O tipo de falha mais recorrente é CWE-79 (Cross-Site Scripting), o que sugere fragilidades persistentes no tratamento de entradas do usuário na aplicação. A existência de PoC pública para ao menos uma vulnerabilidade eleva o risco operacional, especialmente em ambientes de saúde onde o sistema frequentemente lida com dados sensíveis de pacientes.

CVE-2023-2948HIGHCross-site Scripting (XSS) - Generic in openemr/openemrEPSS 96.7%CVE-2022-2733CRITICALCross-site Scripting (XSS) - Reflected in openemr/openemrEPSS 95.8%CVE-2023-2947MEDIUMCross-site Scripting (XSS) - Stored in openemr/openemrEPSS 90.4%CVE-2022-1179MEDIUMNon-Privilege User Can Created New Rule and Lead to Stored Cross Site Scripting in openemr/openemrEPSS 76.9%CVE-2022-1178HIGHStored Cross Site Scripting in openemr/openemrEPSS 51.6%CVE-2022-1181HIGHStored Cross Site Scripting in openemr/openemrEPSS 51.5%CVE-2025-31121HIGHOpenEMR allows XSS in Patient Image featureEPSS 15.0%CVE-2025-30161HIGHOpenEMR Stored XSS in OpenEMR Bronchitis FormEPSS 10.4%CVE-2025-32794HIGHOpenEMR Stored XSS via Patient Name Field in Procedure OrdersEPSS 8.2%CVE-2026-24848HIGHOpenEMR Arbitrary File Write leading to Remote Code ExecutionEPSS 6.5%CVE-2025-43860HIGHOpemEMR Vulnerable to Stored XSS Attack in the Additional Address Section of Patient DemographicsEPSS 4.6%CVE-2025-69231HIGHOpenEMR has a Stored XSS in GAD-7 Form that Enables Session Hijacking and Privilege EscalationEPSS 3.6%CVE-2026-25746HIGHOpenEMR has SQL Injection VulnerabilityEPSS 3.1%CVE-2020-13567HIGHMultiple SQL injection vulnerabilities exist in phpGACL 3.3.7. A specially crafted HTTP request can lead to a SQL injection. An attacker canEPSS 2.3%CVE-2026-24849CRITICALOpenEMR Arbitrary File Read VulnerabilityEPSS 2.2%CVE-2026-32238CRITICALOpenEMR has Remote Code Execution in backup functionalityEPSS 1.9%CVE-2023-2949HIGHCross-site Scripting (XSS) - Reflected in openemr/openemrEPSS 1.5%CVE-2022-2493HIGHData Access from Outside Expected Data Manager Component in openemr/openemrEPSS 1.1%CVE-2022-4506HIGHUnrestricted Upload of File with Dangerous Type in openemr/openemrEPSS 1.0%CVE-2022-1459HIGHNon-Privilege User Can View Patient’s Disclosures in openemr/openemrEPSS 1.0%