CVE-2020-19364: Open-EMR Openemr

High severity, CVSS 8.8. EPSS: 70.6% chance of exploitation in the next 30 days.

OpenEMR 5.0.1 allows an authenticated attacker to upload and execute malicious PHP scripts through /controller.php.

Affected products

• Open-EMR Openemr: version 5.0.1 only

Published 2021-01-20. Last modified 2026-06-17.