CVE-2018-16795: Open-EMR Openemr

High severity, CVSS 8.8. EPSS: 0.6% chance of exploitation in the next 30 days.

OpenEMR 5.0.1.3 allows Cross-Site Request Forgery (CSRF) via library/ajax and interface/super, as demonstrated by use of interface/super/manage_site_files.php to upload a .php file.

Affected products

• Open-EMR Openemr: version 5.0.1.3 only

Published 2020-12-31. Last modified 2026-06-17.