CVE-2022-25471: Open-EMR Openemr

High severity, CVSS 8.1. EPSS: 0.8% chance of exploitation in the next 30 days.

An Insecure Direct Object Reference (IDOR) vulnerability in OpenEMR 6.0.0 allows any authenticated attacker to access and modify unauthorized areas via a crafted POST request to /modules/zend_modules/public/Installer/register.

Affected products

• Open-EMR Openemr: version 6.0.0 only

Published 2022-03-03. Last modified 2026-06-17.