Rezultati pretraživanja za 'Od datuma: 14.12.2024.'
| ID | CVSS | Sažetak | Zadnje ažurirano | Objavljeno |
|---|---|---|---|---|
| CVE-2026-126445 | 4.3 | OpenEMR before 8.5.0 contains a missing authorization vulnerability that allows any authenticated core user to modify arbitrary Patient Flow Board trackers without the patients/appt permission. Attackers can submit a victim tracker_id to patient_trac | 2026-11-13 10:17:52 | 2026-11-13 10:17:52 |
| CVE-2026-126442 | 8.1 | OpenEMR before 8.5.0 contains a missing authorization vulnerability in create_portallogin.php that allows low-privilege authenticated users to replace patient portal credentials without ACL checks. Attackers can select a victim patient in session and | 2026-11-13 10:17:51 | 2026-11-13 10:17:51 |
| CVE-2026-126441 | 5.3 | OpenEMR before 8.5.0 contains an insecure direct object reference vulnerability in the CAMOS rx_print.php printer that allows authenticated users to read other patients' prescriptions. Attackers can submit forged chrx_ parameters with global prescrip | 2026-11-13 10:17:51 | 2026-11-13 10:17:51 |
| CVE-2026-126438 | 4.3 | OpenEMR before 8.5.0 contains an improper authorization vulnerability in interface/patient_file/rules/patient_data.php that allows read-only patients/med users to modify clinical-rule records. Attackers can submit a global form_entryID row ID to over | 2026-11-13 10:17:50 | 2026-11-13 10:17:50 |
| CVE-2026-126437 | 6.5 | OpenEMR before 8.5.0 contains an authorization bypass vulnerability in portal/lib/download_template.php that allows any authenticated core user to render documents for arbitrary patients by setting isModule. Attackers can submit arbitrary pid and tem | 2026-11-13 10:17:50 | 2026-11-13 10:17:50 |
| CVE-2026-126434 | 8.1 | OpenEMR before 8.5.0 contains a missing authorization vulnerability in interface/forms/procedure_order/common.php that allows authenticated accounts lacking patients/lab permission to read and modify other patients' procedure orders. Attackers can re | 2026-11-13 10:17:50 | 2026-11-13 10:17:50 |
| CVE-2026-126433 | 5.9 | OpenEMR before 8.5.0 contains an improper authorization vulnerability in interface/drugs/dispense_drug.php, which checks only for admin/drugs view permission instead of write permission before dispensing medication. Authenticated users with read-only | 2026-11-13 10:17:50 | 2026-11-13 10:17:50 |
| CVE-2026-126430 | 8.1 | OpenEMR before 8.5.0 contains an sql injection vulnerability that allows any authenticated core user to inject SQL by supplying crafted patient_data field names to the CCR revandapprove controller. Attackers can embed scalar subqueries in the UPDATE | 2026-11-13 10:17:49 | 2026-11-13 10:17:49 |
| CVE-2026-126429 | 6.5 | OpenEMR before 8.5.0 passes authenticated user-controlled HTML from the doc_lib.php content parameter to mPDF, which resolves local files and nested SVG resources. Authenticated patients or core users can submit crafted CSS imports or php://filter SV | 2026-11-13 10:17:49 | 2026-11-13 10:17:49 |
| CVE-2026-126426 | 4.3 | OpenEMR 5.0.2 before 8.5.0 contains a missing authentication vulnerability in mfa_registrations.php and mfa_u2f.php that allows session hijackers to delete MFA factors or register U2F keys without password re-entry. Attackers holding a victim's authe | 2026-11-13 10:17:48 | 2026-11-13 10:17:48 |
| ID | CVSS | Sažetak | Zadnje ažurirano | Objavljeno |
|---|
Stranica
/12885
Zapisa po stranici: