Product by Open-Emr

    OpenEMR

    221 known vulnerabilities in OpenEMR (Open-Emr), 0 of them actively exploited (CISA KEV).

    Key figures

    221

    Vulnerabilities

    0

    Actively exploited (KEV)

    0

    Used by ransomware

    23

    Critical

    Vulnerabilities

    Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.

    Vulnerabilities in OpenEMR (Open-Emr)
    CriticalCVE-2026-24848

    OpenEMR Arbitrary File Write leading to Remote Code Execution

    also in 1 other product

    		9.9
    CriticalCVE-2022-2733

    Cross-site Scripting (XSS) - Reflected in openemr/openemr

    also in 1 other product

    		9.6
    CriticalCVE-2024-22611

    OpenEMR: SQL Injection

    		9.8
    CriticalCVE-2020-13562

    phpGACL: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)

    also in 1 other product

    		9.6
    CriticalCVE-2020-13564

    phpGACL: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)

    also in 1 other product

    		9.6
    CriticalCVE-2020-13563

    phpGACL: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)

    also in 1 other product

    		9.6
    CriticalCVE-2019-14529

    OpenEMR: SQL Injection

    		9.8
    HighCVE-2023-2948

    Cross-site Scripting (XSS) - Generic in openemr/openemr

    also in 1 other product

    		8.3
    HighCVE-2025-69231

    OpenEMR has a Stored XSS in GAD-7 Form that Enables Session Hijacking and Privilege Escalation

    also in 1 other product

    		8.7
    HighCVE-2025-30161

    OpenEMR Stored XSS in OpenEMR Bronchitis Form

    also in 1 other product

    		5.4
    CriticalCVE-2018-17179

    OpenEMR: SQL Injection

    		9.8
    HighCVE-2020-19364

    OpenEMR: security vulnerability

    		8.8
    HighCVE-2019-14530

    OpenEMR: security vulnerability

    		8.8
    HighCVE-2020-36243

    OpenEMR: Command Injection

    		8.8
    HighCVE-2018-15153

    OpenEMR: OS Command Injection

    		8.8
    HighCVE-2026-25746

    OpenEMR has SQL Injection Vulnerability

    also in 1 other product

    		8.8
    CriticalCVE-2018-15152

    OpenEMR: Authentication Bypass

    		9.1
    HighCVE-2025-43860

    OpemEMR Vulnerable to Stored XSS Attack in the Additional Address Section of Patient Demographics

    also in 1 other product

    		7.6
    CriticalCVE-2026-24898

    OpenEMR has an Unauthenticated MedEx Token Disclosure

    also in 1 other product

    		10.0
    CriticalCVE-2026-39932

    OpenEMR 8.2.0 Remote Code Execution via CategoryTree eval() Injection

    also in 1 other product

    		9.1
    HighCVE-2018-9250

    OpenEMR: SQL Injection

    		8.8
    HighCVE-2020-13568

    phpGACL: SQL Injection

    also in 1 other product

    		8.8
    HighCVE-2025-32794

    OpenEMR Stored XSS via Patient Name Field in Procedure Orders

    also in 1 other product

    		7.6
    HighCVE-2018-15139

    OpenEMR: Unrestricted File Upload

    		8.8
    HighCVE-2018-15142

    OpenEMR: Path Traversal

    		8.8

    All vulnerabilities in search

    News

    All products by Open-Emr