LibreHealthIO/lh-ehr

GitHub

github.com

Releases29

Frequency6 months 4 weeks

Last Release almost 5 years ago

Stars296

LibreHealth EHR - Free Open Source Electronic Health Records

CVE History

CVE	Published	CVSS v3	CVSS v2
CVE-2022-31496 ↗	Jun 9, 2022Thursday, 9 June 2022, 00:15	8.8 HIGH	9 HIGH
LibreHealth EHR Base 2.0.0 allows incorrect interface/super/manage_site_files.php access.
CVE-2022-31497 ↗	Jun 8, 2022Wednesday, 8 June 2022, 12:15	6.1 MEDIUM	4.3 MEDIUM
LibreHealth EHR Base 2.0.0 allows interface/main/finder/finder_navigation.php patient XSS.
CVE-2022-31495 ↗	Jun 7, 2022Tuesday, 7 June 2022, 15:15	6.1 MEDIUM	4.3 MEDIUM
LibreHealth EHR Base 2.0.0 allows gacl/admin/acl_admin.php return_page XSS.
CVE-2022-31494 ↗	Jun 6, 2022Monday, 6 June 2022, 23:15	6.1 MEDIUM	4.3 MEDIUM
LibreHealth EHR Base 2.0.0 allows gacl/admin/acl_admin.php action XSS.
CVE-2022-31498 ↗	Jun 6, 2022Monday, 6 June 2022, 21:15	6.1 MEDIUM	4.3 MEDIUM
LibreHealth EHR Base 2.0.0 allows interface/orders/patient_match_dialog.php key XSS.
CVE-2022-31492 ↗	Jun 6, 2022Monday, 6 June 2022, 20:15	6.1 MEDIUM	4.3 MEDIUM
Cross Site scripting (XSS) vulnerability inLibreHealth EHR Base 2.0.0 via interface/usergroup/usergroup_admin_add.php Username.
CVE-2022-31493 ↗	Jun 6, 2022Monday, 6 June 2022, 19:15	6.1 MEDIUM	4.3 MEDIUM
LibreHealth EHR Base 2.0.0 allows gacl/admin/acl_admin.php acl_id XSS.
CVE-2022-29939 ↗	May 5, 2022Thursday, 5 May 2022, 12:15	5.4 MEDIUM	3.5 LOW
In LibreHealth EHR 2.0.0, lack of sanitization of the GET parameters debug and InsId in interface\billing\sl_eob_process.php leads to multiple cross-site scripting (XSS) vulnerabilities.
CVE-2022-29940 ↗	May 5, 2022Thursday, 5 May 2022, 12:15	5.4 MEDIUM	3.5 LOW
In LibreHealth EHR 2.0.0, lack of sanitization of the GET parameters formseq and formid in interface\orders\find_order_popup.php leads to multiple cross-site scripting (XSS) vulnerabilities.
CVE-2022-29938 ↗	May 5, 2022Thursday, 5 May 2022, 12:15	8.8 HIGH	6.5 MEDIUM
In LibreHealth EHR 2.0.0, lack of sanitization of the GET parameter payment_id in interface\billing\new_payment.php via interface\billing\payment_master.inc.php leads to SQL injection.
CVE-2018-1000839 ↗	Dec 20, 2018Thursday, 20 December 2018, 15:29	—	6.5 MEDIUM
LH-EHR version REL-2_0_0 contains a Arbitrary File Upload vulnerability in Profile picture upload that can result in Remote Code Execution. This attack appear to be exploitable via Uploading a PHP file with image MIME type.
CVE-2018-1000650 ↗	Aug 20, 2018Monday, 20 August 2018, 19:31	—	6.5 MEDIUM
LibreHealthIO lh-ehr version REL-2.0.0 contains a SQL Injection vulnerability in Show Groups Popup SQL query functions that can result in Ability to perform malicious database queries. This attack appear to be exploitable via User controlled parameters.
CVE-2018-1000649 ↗	Aug 20, 2018Monday, 20 August 2018, 19:31	—	6.5 MEDIUM
LibreHealthIO lh-ehr version REL-2.0.0 contains a Authenticated Unrestricted File Write in letter.php (2) vulnerability in Patient file letter functions that can result in Write files with malicious content and may lead to remote code execution. This attack appear to be exploitable via User controlled input.
CVE-2018-1000648 ↗	Aug 20, 2018Monday, 20 August 2018, 19:31	—	6.5 MEDIUM
LibreHealthIO lh-ehr version REL-2.0.0 contains a Authenticated Unrestricted File Write vulnerability in Patient file letter functions that can result in Write files with malicious content and may lead to remote code execution. This attack appear to be exploitable via User controlled parameters.
CVE-2018-1000647 ↗	Aug 20, 2018Monday, 20 August 2018, 19:31	—	5.5 MEDIUM
LibreHealthIO lh-ehr version REL-2.0.0 contains a Authenticated Unrestricted File Deletion vulnerability in Import template that can result in Denial of service. This attack appear to be exploitable via User controlled parameter.
CVE-2018-1000646 ↗	Aug 20, 2018Monday, 20 August 2018, 19:31	—	6.5 MEDIUM
LibreHealthIO LH-EHR version REL-2.0.0 contains an Authenticated Unrestricted File Write vulnerability in Import template that can result in write files with malicious content and may lead to remote code execution.
CVE-2018-1000645 ↗	Aug 20, 2018Monday, 20 August 2018, 19:31	—	4 MEDIUM
LibreHealthIO lh-ehr version <REL-2.0.0 contains an Authenticated Local File Disclosure vulnerability in Importing of templates allows local file disclosure that can result in Disclosure of sensitive files on the server. This attack appear to be exploitable via User controlled variable in import templates function.