VulDB Recent Entries

A vulnerability identified as problematic has been detected in OpenRemote up to 1.32.1. Impacted is an unknown function of the file /configuration/manager of the component Admin Endpoints. The manipulation leads to improper authorization. This vulnerability is listed as CVE-2026-124436. The attack may be initiated remotely. There is no available exploit. You should upgrade the affected component.

A vulnerability categorized as problematic has been discovered in WWBN AVideo up to 29.7.0. This issue affects some unknown processing of the file plugin/AI/receiveAsync.json.php of the component AI. Executing a manipulation of the argument lang can lead to path traversal. This vulnerability is tracked as CVE-2026-124424. The attack can be launched remotely. No exploit exists.

A vulnerability was found in OpenEMR up to 8.3.x. It has been rated as critical. This vulnerability affects unknown code of the file library/ESign/Router.php of the component ESign Router. Performing a manipulation of the argument module results in file inclusion. This vulnerability is identified as CVE-2026-124467. The attack can be initiated remotely. There is not any exploit available. Upgrading the affected component is advised.

A vulnerability was found in OpenEMR up to 8.2.x. It has been declared as problematic. This affects an unknown part of the file interface/forms/eye_mag/report.php of the component Eye Exam Report. Such manipulation leads to cross site scripting. This vulnerability is referenced as CVE-2026-124452. It is possible to launch the attack remotely. No exploit is available. It is recommended to upgrade the affected component.

A vulnerability was found in OpenEMR up to 8.2.x. It has been classified as problematic. Affected by this issue is some unknown functionality of the file ajax_save.php. This manipulation causes cross site scripting. The identification of this vulnerability is CVE-2026-124463. It is possible to initiate the attack remotely. There is no exploit available. Upgrading the affected component is recommended.

A vulnerability was found in OpenEMR up to 8.2.x and classified as critical. Affected by this vulnerability is an unknown functionality of the file interface/billing/sl_eob_patient_note.php of the component Billing Patient Notes. The manipulation of the argument patient_id results in improper authorization. This vulnerability was named CVE-2026-124472. The attack may be performed from remote. There is no available exploit. It is suggested to upgrade the affected component.

A vulnerability has been found in OpenEMR up to 8.2.x and classified as critical. Affected is an unknown function of the file portal/lib/persist.php of the component Portal. The manipulation of the argument setting_patient leads to authorization bypass. This vulnerability is uniquely identified as CVE-2026-124453. The attack is possible to be carried out remotely. No exploit exists. The affected component should be upgraded.

A vulnerability, which was classified as critical, was found in OpenEMR up to 8.2.x. This impacts an unknown function of the file interface/billing/sl_eob_invoice.php of the component Billing Interface. Executing a manipulation of the argument ID can lead to improper authorization. This vulnerability is handled as CVE-2026-124471. The attack can be executed remotely. There is not any exploit available. You should upgrade the affected component.

A vulnerability, which was classified as critical, has been found in OpenEMR up to 8.2.x. This affects an unknown function of the file portal/lib/persist.php of the component Patient Settings Persistence. Performing a manipulation of the argument setting_patient results in improper control of resource identifiers. This vulnerability is known as CVE-2026-124475. Remote exploitation of the attack is possible. No exploit is available. It is advisable to upgrade the affected component.

A vulnerability classified as problematic was found in OpenEMR up to 8.2.x. The impacted element is an unknown function of the file portal/report/portal_custom_report.php. Such manipulation of the argument issue_ leads to authorization bypass. This vulnerability is traded as CVE-2026-124470. The attack may be launched remotely. There is no exploit available. Upgrading the affected component is advised.

A vulnerability classified as critical has been found in OpenEMR up to 8.2.x. The affected element is an unknown function of the file interface/billing/sl_eob_process.php of the component Billing Interface. This manipulation of the argument eraname causes path traversal. This vulnerability appears as CVE-2026-124457. The attack may be initiated remotely. There is no available exploit. It is recommended to upgrade the affected component.

A vulnerability described as critical has been identified in OpenEMR up to 8.2.x. Impacted is an unknown function of the file soap/view.php of the component Encounter Form View And Save Endpoints. The manipulation results in improper control of resource identifiers. This vulnerability is reported as CVE-2026-124459. The attack can be launched remotely. No exploit exists. Upgrading the affected component is recommended.

A vulnerability marked as problematic has been reported in thorsten phpMyFAQ up to 4.1.10. This issue affects some unknown processing of the file /admin/group/confirm. The manipulation of the argument group_list_select leads to improper privilege management. This vulnerability is documented as CVE-2026-124433. The attack can be initiated remotely. There is not any exploit available. It is suggested to upgrade the affected component.

A vulnerability labeled as critical has been found in Craft CMS up to 5.11.1. This vulnerability affects the function renderObjectTemplate of the component Twig Templates. Executing a manipulation of the argument returnUrl can lead to os command injection. This vulnerability is registered as CVE-2026-124430. It is possible to launch the attack remotely. No exploit is available. The affected component should be upgraded.

A vulnerability identified as problematic has been detected in thorsten phpMyFAQ up to 4.1.10/4.2.0-beta.2. This affects an unknown part of the component WebAuthn. Performing a manipulation results in information disclosure. This vulnerability is cataloged as CVE-2026-124432. It is possible to initiate the attack remotely. There is no exploit available. You should upgrade the affected component.

A vulnerability categorized as critical has been discovered in OpenEMR up to 8.3.x. Affected by this issue is some unknown functionality of the file src/Common/Auth/OneTimeAuth.php of the component OneTimeAuth. Such manipulation leads to authentication bypass by capture-replay. This vulnerability is listed as CVE-2026-124445. The attack may be performed from remote. There is no available exploit. It is advisable to upgrade the affected component.

A vulnerability was found in OpenEMR up to 8.2.x. It has been rated as critical. Affected by this vulnerability is an unknown functionality of the file library/ajax/upload.php of the component Upload. This manipulation of the argument doc_id causes improper authorization. This vulnerability is tracked as CVE-2026-124461. The attack is possible to be carried out remotely. No exploit exists. Upgrading the affected component is advised.

A vulnerability was found in OpenEMR up to 8.2.9. It has been declared as critical. Affected is an unknown function of the file portal/lib/paylib.php of the component Payment Processing. The manipulation of the argument form_pid/patient_id_cc results in improper control of resource identifiers. This vulnerability is identified as CVE-2026-124476. The attack can be executed remotely. There is not any exploit available. It is recommended to upgrade the affected component.

A vulnerability was found in OpenEMR up to 8.2.x. It has been classified as critical. This impacts an unknown function of the file public/reports/list_report.php of the component oe-module-prior-authorizations. The manipulation of the argument ID leads to improper control of resource identifiers. This vulnerability is referenced as CVE-2026-124456. Remote exploitation of the attack is possible. No exploit is available. Upgrading the affected component is recommended.

A vulnerability was found in OpenEMR up to 8.2.x and classified as critical. This affects the function disposeDocument of the file sqlconf.php of the component Fax/Sms Module. Executing a manipulation of the argument file_path can lead to improper access controls. The identification of this vulnerability is CVE-2026-124450. The attack may be launched remotely. There is no exploit available. It is suggested to upgrade the affected component.