Openemr

A public exploit (EDB-52610) has been published for OpenEMR versions prior to 7.0.4, detailing an authenticated arbitrary file read vulnerability (CVE-2026-24849) in the Fax/SMS module's `EtherFaxActions::disposeDoc()` method, which allows a low-privileged authenticated user to read and potentially delete any file accessible by the web server user due to a lack of path validation on the `file_path` request parameter.

OpenEMR before version 8.0.0.3 is vulnerable to XML External Entity (XXE) injection, allowing an authenticated user with access to the Carecoordination module to upload a crafted CCDA document and read arbitrary files from the server.

OpenEMR versions up to 8.0.0.2 are vulnerable to SQL injection in the patient selection feature, which can be exploited by authenticated attackers due to insufficient input validation, potentially leading to unauthorized data access and modification.

OpenEMR versions before 8.0.0.3 contain a missing authorization vulnerability in the AJAX deletion endpoint that allows any authenticated user to delete patient data.

A stored cross-site scripting (XSS) vulnerability in OpenEMR's CCDA document preview (CVE-2026-33932) allows an attacker to execute arbitrary JavaScript in a clinician's browser session by uploading a malicious CCDA document.

A blind SQL injection vulnerability exists in the PostCalendar module of OpenEMR versions prior to 8.0.0.3 due to improper sanitization of the `dels` POST parameter, potentially allowing attackers to execute arbitrary SQL commands.

OpenEMR version 7.0.1 is vulnerable to an authentication brute force attack where attackers can bypass rate limiting by sending repeated login attempts, leading to potential unauthorized access.