CVE-2018-15143: Open-EMR Openemr

Critical severity, CVSS 9.8. EPSS: 2.2% chance of exploitation in the next 30 days.

Multiple SQL injection vulnerabilities in portal/find_appt_popup_user.php in versions of OpenEMR before 5.0.1.4 allow a remote attacker to execute arbitrary SQL commands via the (1) catid or (2) providerid parameter.

Affected products

• Open-EMR Openemr: before 5.0.1.4 (fixed in 5.0.1.4)

Published 2018-08-13. Last modified 2026-06-17.