Vendor

    OpenEMR

    138 known vulnerabilities in products by OpenEMR, 0 of them actively exploited (CISA KEV).

    Key figures

    138

    Vulnerabilities

    0

    Actively exploited (KEV)

    0

    Used by ransomware

    11

    Critical

    Vulnerabilities

    Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.

    Vulnerabilities in OpenEMR
    CriticalCVE-2026-24848

    OpenEMR Arbitrary File Write leading to Remote Code Execution

    also in 1 other product

    		9.9
    CriticalCVE-2022-2733

    Cross-site Scripting (XSS) - Reflected in openemr/openemr

    also in 1 other product

    		9.6
    HighCVE-2023-2948

    Cross-site Scripting (XSS) - Generic in openemr/openemr

    also in 1 other product

    		8.3
    HighCVE-2025-69231

    OpenEMR has a Stored XSS in GAD-7 Form that Enables Session Hijacking and Privilege Escalation

    also in 1 other product

    		8.7
    HighCVE-2025-30161

    OpenEMR Stored XSS in OpenEMR Bronchitis Form

    also in 1 other product

    		5.4
    HighCVE-2026-25746

    OpenEMR has SQL Injection Vulnerability

    also in 1 other product

    		8.8
    HighCVE-2025-43860

    OpemEMR Vulnerable to Stored XSS Attack in the Additional Address Section of Patient Demographics

    also in 1 other product

    		7.6
    CriticalCVE-2026-24898

    OpenEMR has an Unauthenticated MedEx Token Disclosure

    also in 1 other product

    		10.0
    CriticalCVE-2026-39932

    OpenEMR 8.2.0 Remote Code Execution via CategoryTree eval() Injection

    also in 1 other product

    		9.1
    HighCVE-2025-32794

    OpenEMR Stored XSS via Patient Name Field in Procedure Orders

    also in 1 other product

    		7.6
    HighCVE-2022-1181

    Stored Cross Site Scripting in openemr/openemr

    also in 1 other product

    		8.0
    HighCVE-2025-31121

    OpenEMR allows XSS in Patient Image feature

    also in 1 other product

    		5.4
    CriticalCVE-2026-24849

    OpenEMR Arbitrary File Read Vulnerability

    also in 1 other product

    		10.0
    HighCVE-2022-1178

    Stored Cross Site Scripting in openemr/openemr

    also in 1 other product

    		7.3
    CriticalCVE-2026-32238

    OpenEMR has Remote Code Execution in backup functionality

    also in 1 other product

    		9.1
    MediumCVE-2023-2947

    Cross-site Scripting (XSS) - Stored in openemr/openemr

    also in 1 other product

    		4.7
    MediumCVE-2022-1179

    Non-Privilege User Can Created New Rule and Lead to Stored Cross Site Scripting in openemr/openemr

    also in 1 other product

    		4.6
    CriticalCVE-2020-13567

    phpGACL: SQL Injection

    also in 2 other products

    		8.8
    HighCVE-2026-67611

    OpenEMR 8.2.0 OAuth2 Password Grant Authentication Bypass via SMART Configuration

    also in 1 other product

    		8.1
    HighCVE-2023-2949

    Cross-site Scripting (XSS) - Reflected in openemr/openemr

    also in 1 other product

    		8.3
    HighCVE-2026-39931

    OpenEMR Authenticated SQL Injection via backup.php Import Feature

    also in 1 other product

    		7.2
    HighCVE-2026-23627

    OpenEMR has SQL Injection in Immunization Search/Report

    also in 1 other product

    		8.8
    HighCVE-2026-49142

    OpenEMR Before 8.5.0 SQL Injection via form_icd_codes[]

    		8.8
    HighCVE-2026-40506

    OpenEMR Path Traversal Arbitrary Directory Deletion via standard_tables_manage.php

    		6.5
    CriticalCVE-2026-24908

    OpenEMR has SQL Injection in Patient API Sort Parameter

    also in 1 other product

    		10.0

    All vulnerabilities in search

    News

    Products

    Products by OpenEMR
    OpenEMR1010
    Openemr/openemr370