OpenEMR 7.0.3
Approved changes feed: RSS · Atom
cpe:2.3:a:open-emr:openemr:7.0.3:*:*:*:*:*:*:*part: a version: 7.0.3 update: *
| Vendor | Open Emr (4d2478a1-b549-59b7-9c3b-4ea8a9eef12c) |
|---|---|
| Product | Openemr (fd706c85-27bf-51b4-9a1f-14d712ef8e83) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
Notes
Imported from NVD CPE 2.0 feed
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
pkg:docker/openemr/openemr |
purl2cpe | 2026-06-01 10:11:40.905601 |
pkg:github/openemr/openemr |
purl2cpe | 2026-06-01 10:11:40.905602 |
pkg:sourceforge/openemr |
purl2cpe | 2026-06-01 10:11:40.905603 |
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2025-67645 |
vulnerable | 2026-06-08 07:41:20.270625 |
OpenEMR Vulnerable to Broken Access Control in Profile Edit Endpoint
HIGH (8.8)
OpenEMR is a free and open source electronic health records and medical practice management application. Versions prior to 7.0.4 have a broken access control in the Profile Edit endpoint. An authenticated normal user can modify the request parameters (pubpid / pid) to reference another user’s record; the server accepts the modified IDs and applies the changes to that other user’s profile. This allows one user to alter another user’s profile data (name, contact info, etc.), and could enable account takeover. Version 7.0.4 fixes the issue.
Published: 2026-01-27T23:20:18.515Z
Updated: 2026-01-28T21:05:33.217Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-54347 |
vulnerable | 2026-06-08 06:19:40.573997 |
OpenEMR 7.0.1 Authentication Brute Force Mitigation Bypass
HIGH (7.5)
OpenEMR 7.0.1 contains an authentication brute force vulnerability that allows attackers to bypass rate limiting protections by sending repeated login attempts to the main login endpoint. Attackers can submit POST requests with authUser and clearPass parameters to systematically test username and password combinations without account lockout restrictions.
Published: 2026-05-05T11:24:50.970Z
Updated: 2026-05-06T14:08:52.856Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.
Inspect record JSON
Open this panel to browse, search, copy or download the JSON record.