Vulnerabilidades em openemr

126 resultados
Análise Vexday

O OpenEMR acumula 120 CVEs catalogadas, com 7 classificadas como críticas e nenhuma confirmada em exploração ativa no catálogo CISA KEV, taxa abaixo da média geral do catálogo. Apesar da ausência de exploração ativa confirmada, o cenário merece atenção: CVE-2023-2948 apresenta score EPSS de 0,9673, indicando probabilidade muito elevada de exploração nos próximos 30 dias e devendo ser tratada como prioridade imediata de remediação. O tipo de falha mais recorrente é CWE-79 (Cross-Site Scripting), o que sugere fragilidades persistentes no tratamento de entradas do usuário na aplicação. A existência de PoC pública para ao menos uma vulnerabilidade eleva o risco operacional, especialmente em ambientes de saúde onde o sistema frequentemente lida com dados sensíveis de pacientes.

CVE-2022-2732HIGHMissing Authorization in openemr/openemrEPSS 0.9%CVE-2022-1461HIGHNon Privilege User can Enable or Disable Registered in openemr/openemrEPSS 0.9%CVE-2022-1177MEDIUMAccounting User Can Download Patient Reports in openemr in openemr/openemrEPSS 0.9%CVE-2022-4504HIGHImproper Input Validation in openemr/openemrEPSS 0.9%CVE-2025-29789MEDIUMOpenEMR Has Directory Traversal in Load Code featureEPSS 0.8%CVE-2022-2734CRITICALImproper Restriction of Rendered UI Layers or Frames in openemr/openemrEPSS 0.8%CVE-2023-2942HIGHImproper Input Validation in openemr/openemrEPSS 0.8%CVE-2026-23627HIGHOpenEMR has SQL Injection in Immunization Search/ReportEPSS 0.8%CVE-2026-39932CRITICALOpenEMR 8.2.0 Remote Code Execution via CategoryTree eval() InjectionEPSS 0.8%CVE-2022-2730MEDIUMAuthorization Bypass Through User-Controlled Key in openemr/openemrEPSS 0.8%CVE-2022-1458HIGHStored XSS Leads To Session Hijacking in openemr/openemrEPSS 0.7%CVE-2022-4505HIGHAuthorization Bypass Through User-Controlled Key in openemr/openemrEPSS 0.7%CVE-2022-4615HIGHCross-site Scripting (XSS) - Reflected in openemr/openemrEPSS 0.7%CVE-2022-4502HIGHCross-site Scripting (XSS) - Reflected in openemr/openemrEPSS 0.6%CVE-2022-2824HIGHAuthorization Bypass Through User-Controlled Key in openemr/openemrEPSS 0.6%CVE-2023-2943MEDIUMCode Injection in openemr/openemrEPSS 0.6%CVE-2022-2494MEDIUMCross-site Scripting (XSS) - Stored in openemr/openemrEPSS 0.6%CVE-2023-2674HIGHImproper Access Control in openemr/openemrEPSS 0.6%CVE-2022-4567HIGHImproper Access Control in openemr/openemrEPSS 0.6%CVE-2022-1180MEDIUMReflected Cross Site Scripting in openemr/openemrEPSS 0.6%