Publikacje w kolejności czasu
Wszystkie technologie
| Oprogramowanie | Podatność i krótki opis | Zapisz | |||
|---|---|---|---|---|---|
| openemr | CVE-2026-126471 OpenEMR before 8.5.0 contains a missing authorization vulnerability in print_referral.php and trend_form.php that allows low-privileged Front Office users to access patient PHI without patients:med permission. Attackers can directly request these endpoints with arbitrary patient_id values to… |
6,5 | 0,26 % | Brak wpisu w KEV nie wyklucza ataków | |
| openemr | CVE-2026-126472 OpenEMR before 8.5.0 contains a missing authorization vulnerability in ccdaservice/ccda_gateway.php that allows any authenticated low-privilege staff user to retrieve other patients' C-CDA documents. Attackers can request the view or dl action with sequential pid values and their own CSRF token to… |
8,7 | 0,44 % | Brak wpisu w KEV nie wyklucza ataków | |
| openemr | CVE-2026-126473 OpenEMR before 8.4.0 contains OAuth scope canonicalization and containment flaws that allow unauthenticated attackers to obtain unapproved system-level FHIR access. Attackers can register a colon-form system:Patient.read client that bypasses approval, then request unregistered system/Patient.write… |
9,3 | 0,49 % | Brak wpisu w KEV nie wyklucza ataków | |
| openemr | CVE-2026-126474 OpenEMR before 8.5.0 contains a reflected cross-site scripting vulnerability in the ACL module that allows attackers to execute JavaScript in authenticated sessions via the module_id parameter. Attackers can deliver crafted acl/index or acl/acl links that inject unencoded input into inline script… |
6,1 | 0,19 % | Brak wpisu w KEV nie wyklucza ataków | |
| openemr | CVE-2026-126475 OpenEMR before 8.5.0 contains a reflected cross-site scripting vulnerability that allows authenticated attackers to execute JavaScript by injecting payloads into the searchEleNo POST parameter of the application/index/search endpoint. Attackers can break out of unencoded HTML attributes in… |
6,1 | 0,19 % | Brak wpisu w KEV nie wyklucza ataków | |
| openemr | CVE-2026-126464 OpenEMR before 8.5.0 contains a server-side request forgery vulnerability in PatientPortalPDFDocumentCreator::createPdfObject() that allows authenticated patients to make the server issue HTTP GET requests. Attackers can submit img src, inline style url(), or reinserted unpurified style blocks via… |
5,3 | 0,24 % | Brak wpisu w KEV nie wyklucza ataków | |
| openemr | CVE-2026-126465 OpenEMR before 8.5.0 contains an SQL injection vulnerability in the patient portal api/onsiteactivityviews endpoint that allows any authenticated staff user to inject SQL through unquoted Id_BitwiseAnd Criteria values. Attackers can close the bitwise parenthesis and append OR or UNION SELECT… |
7,1 | 0,43 % | Brak wpisu w KEV nie wyklucza ataków | |
| openemr | CVE-2026-126466 OpenEMR before 8.5.0 contains a missing authorization vulnerability that allows any authenticated user to create patient records and enumerate patients by omitting aclCheckCore() checks. Attackers can POST to new_comprehensive_save.php to create patients with insurance PHI, or query… |
8,8 | 0,38 % | Brak wpisu w KEV nie wyklucza ataków | |
| openemr | CVE-2026-126467 OpenEMR before 8.5.0 contains a mass assignment vulnerability in ObservationController::processEnhancedFormSave() that allows authenticated low-privilege users to forge authorization flags through an incomplete field blacklist. Attackers can submit authorized=1 or override the id field alongside… |
6,5 | 0,27 % | Brak wpisu w KEV nie wyklucza ataków | |
| openemr | CVE-2026-126468 OpenEMR before 8.5.0 contains a missing authorization vulnerability that allows any authenticated low-privilege user to access reports, dated reminders, and batch reminder endpoints lacking AclMain::aclCheckCore() checks. Attackers can request patient_list.php, amc_full_report.php,… |
8,7 | 0,37 % | Brak wpisu w KEV nie wyklucza ataków | |
| openemr | CVE-2026-126469 OpenEMR before 8.5.0 contains a missing authorization vulnerability in several custom/ scripts that rely only on session authentication and never call AclMain::aclCheckCore(). Any authenticated low-privilege user can request export_labworks.php, chart_tracker.php, or export_registry_xml.php to… |
8,7 | 0,52 % | Brak wpisu w KEV nie wyklucza ataków | |
| openemr | CVE-2026-126458 OpenEMR before 8.5.0 contains a missing authorization vulnerability in authorizations_full.php that allows any authenticated staff user to authorize arbitrary patients' clinical records. Attackers can send a mode=authorize request with an attacker-chosen pid and their own CSRF token to set… |
8,8 | 0,32 % | Brak wpisu w KEV nie wyklucza ataków | |
| openemr | CVE-2026-126460 OpenEMR before 8.5.0 contains a persistent SQL injection vulnerability in SLEOB::slInvoiceNumber(), where the CLP01 claim control number from uploaded X12 835 ERA files is concatenated unescaped into a query. Attackers with billing write access can upload a crafted .edi file via sl_eob_search.php… |
7,1 | 0,33 % | Brak wpisu w KEV nie wyklucza ataków | |
| openemr | CVE-2026-126461 OpenEMR before 8.5.0 contains a missing authorization vulnerability in library/ajax/user_settings.php that lets any authenticated user persist arbitrary global configuration overrides. Attackers can POST global:-prefixed keys to re-point external service hosts like CouchDB, eRx, phiMail, or SMTP… |
7,1 | 0,37 % | Brak wpisu w KEV nie wyklucza ataków | |
| openemr | CVE-2026-126462 OpenEMR before 8.5.0 contains a stored cross-site scripting vulnerability that allows authenticated users with Eye Exam edit permission to inject scripts via the Next Visit Orders PLAN[] field. Attackers can store a payload closing the textarea in view.php, executing JavaScript when another user… |
5,4 | 0,17 % | Brak wpisu w KEV nie wyklucza ataków | |
| openemr | CVE-2026-126463 OpenEMR before 8.5.0 contains multiple sql injection vulnerabilities that allow authenticated users to inject payloads through ERA CLP01, form_facility, form_icd_codes, and POST key names. Attackers can perform UNION, blind, and error-based injection to read users_secure password hashes and… |
7,1 | 0,29 % | Brak wpisu w KEV nie wyklucza ataków | |
| openemr | CVE-2026-126452 OpenEMR before 8.5.0 contains a missing authorization vulnerability in diagnosis_full.php that allows authenticated users to delete or clear any billing record by ID. Attackers can supply a target billing ID in the id parameter with delete or clear mode to deactivate other patients' charges and… |
7,1 | 0,35 % | Brak wpisu w KEV nie wyklucza ataków | |
| openemr | CVE-2026-126453 OpenEMR before 8.5.0 contains an inverted comparison in Document::has_expired() that causes the FHIR Binary download endpoint to treat time-limited PHI documents as unexpired after their one-hour lifetime. Authenticated users still authorized for a Binary/{id} resource can download expired bulk… |
6,5 | 0,26 % | Brak wpisu w KEV nie wyklucza ataków | |
| openemr | CVE-2026-126454 OpenEMR before 8.5.0 lacks rate limiting or lockout on TOTP submission, allowing attackers with a valid password to brute-force the 6-digit MFA code. Attackers can script repeated POST requests to main_screen.php or the OAuth2 authorization flow with re-submitted hidden credentials to bypass… |
8,1 | 0,41 % | Brak wpisu w KEV nie wyklucza ataków | |
| openemr | CVE-2026-126455 OpenEMR before 8.5.0 contains multiple missing authorization and SQL injection defects across report, portal, transaction, and immunization components. Low-privileged Front Office clerks can chain these to read arbitrary database tables including users_secure hashes, hijack patient portal… |
8,6 | 0,34 % | Brak wpisu w KEV nie wyklucza ataków | |
| openemr | CVE-2026-126456 OpenEMR before 8.5.0 contains a stored cross-site scripting vulnerability in the Fee Sheet notecodes field, which is escaped with the wrong context. Attackers with clinician access can inject a payload that breaks out of the single-quoted value attribute and executes in higher-privileged users'… |
5,1 | 0,24 % | Brak wpisu w KEV nie wyklucza ataków | |
| openemr | CVE-2026-126457 OpenEMR before 8.5.0 contains a missing authorization vulnerability in InstallerController that allows any authenticated user to modify module administration settings without the admin/manage_modules permission. Low-privileged users such as Front Office clerks can POST to saveConfig, DeleteAcl,… |
6,5 | 0,22 % | Brak wpisu w KEV nie wyklucza ataków | |
| openemr | CVE-2026-126445 OpenEMR before 8.5.0 contains a missing authorization vulnerability that allows any authenticated core user to modify arbitrary Patient Flow Board trackers without the patients/appt permission. Attackers can submit a victim tracker_id to patient_tracker_status.php or drug_screen_completed.php to… |
4,3 | 0,19 % | Brak wpisu w KEV nie wyklucza ataków | |
| openemr | CVE-2026-126446 OpenEMR before 8.5.0 contains a missing authorization vulnerability that allows any authenticated core user to retrieve destroyed-drug records because destroyed_drugs_report.php lacks the admin/drugs or inventory/reporting ACL check. Attackers can submit the report refresh form with a chosen date… |
4,3 | 0,2 % | Brak wpisu w KEV nie wyklucza ataków | |
| openemr | CVE-2026-126447 OpenEMR before 8.5.0 contains a missing authorization vulnerability in trusted-messages-ajax.php that allows any authenticated core user to send Direct messages without the patients/notes permission. Attackers with zero-ACL accounts can submit chosen recipients and message bodies sent via the… |
6,0 | 0,25 % | Brak wpisu w KEV nie wyklucza ataków |
Źródła i pokrycie danych
Zakres katalogu: ostatnie 365 dni oraz wszystkie zachowane KEV.
Ostatnio zakończone okno publikacji NVD: 14.11.2026, 23:02 UTC – 15.11.2026, 04:02 UTC. To pojedyncze okno importu, nie granica pokrycia katalogu.