CVE-2022-1459

HighCVSS 8.3/10Last modified Jun 17, 2026

Description

Non-Privilege User Can View Patient’s Disclosures in GitHub repository openemr/openemr prior to 6.1.0.1.

Metrics

CVSS 3.1 8.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L

Weakness enumeration

CWE-1118CWE-639

Affected software

VendorProductVersions
openemropenemr/openemr>= unspecified, < 6.1.0.1

References

Timeline

Published
Apr 25, 2022
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2022

CVE-2022-14604.9An issue has been discovered in GitLab affecting all versions starting from 9.2 before 14.8.6, all versions starting from 14.9 before 14.9.4CVE-2022-14616.5Non Privilege User can Enable or Disable Registered in GitHub repository openemr/openemr prior to 6.1.0.1.CVE-2022-14626.3An out-of-bounds read flaw was found in the Linux kernel’s TeleTYpe subsystem. The issue occurs in how a user triggers a race condition usinCVE-2022-14638.8The Booking Calendar plugin for WordPress is vulnerable to PHP Object Injection via the [bookingflextimeline] shortcode in versions up to, aCVE-2022-14645.4Stored xss bug in GitHub repository gogs/gogs prior to 0.12.7. As the repo is public , any user can view the report and when open the attachCVE-2022-14656.1The WPC Smart Wishlist for WooCommerce WordPress plugin before 2.9.9 does not sanitise and escape a parameter before outputting it back in aCVE-2022-14666.5Due to improper authorization, Red Hat Single Sign-On is vulnerable to users performing actions that they should not be allowed to perform. CVE-2022-14679.9Windows OS can be configured to overlay a “language bar” on top of any application. When this OS functionality is enabled, the OS language bCVE-2022-14684.3On all versions of 17.0.x, 16.1.x, 15.1.x, 14.1.x, 13.1.x, 12.1.x, and 11.6.x on F5 BIG-IP, an authenticated iControl REST user with at leasCVE-2022-14694.8The FiboSearch WordPress plugin before 1.17.0 does not sanitise and escape some of its settings, which could allow high privilege users suchCVE-2022-14706.1The Ultimate WooCommerce CSV Importer WordPress plugin through 2.0 does not sanitise and escape the imported data before outputting it back CVE-2022-14719.8SnakeYaml's Constructor() class does not restrict types which can be instantiated during deserialization. Deserializing yaml content provide
CVE-2022-1459: High severity, CVSS 8.3 | Vulnix