PT-2026-146718
CVE-2026-126432
·
تاريخ النشر
2026-11-13
·
تاريخ التحديث
2026-11-13
الوصف من
CVSS 3.1
5.9
متوسطةالمقاييسAV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:L
OpenEMR before 8.5.0 contains an improper authorization vulnerability in interface/orders/list reports.php that allows read-only users to transmit lab orders because the patients/med check ignores write permission. Authenticated attackers can submit form xmit with arbitrary procedure order IDs to send HL7 orders containing SSNs, insurance, and diagnoses to laboratories and mark them transmitted.
وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾