CVE-2022-24643

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

A stored cross-site scripting (XSS) issue was discovered in the OpenEMR Hospital Information Management System version 6.0.0.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://github.com/openemrProduct, Third Party Advisory
https://securityforeveryone.com/blog/openemr-0-day-stored-cross-site-scripting-xss-vulnerability-cve-2022-24643Third Party Advisory
https://www.open-emr.org/Vendor Advisory
https://github.com/openemrProduct, Third Party Advisory
https://securityforeveryone.com/blog/openemr-0-day-stored-cross-site-scripting-xss-vulnerability-cve-2022-24643Third Party Advisory
https://www.open-emr.org/Vendor Advisory

Timeline

Published: Mar 25, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-246448.8ZZ Inc. KeyMouse Windows 3.08 and prior is affected by a remote code execution vulnerability during an unauthenticated update. To exploit th CVE-2022-246467.5Hospital Management System v4.0 was discovered to contain a SQL injection vulnerability in /Hospital-Management-System-master/contact.php vi CVE-2022-246478.1Cuppa CMS v1.0 was discovered to contain an arbitrary file deletion vulnerability via the unlink() function.CVE-2022-24657.8Rockwell Automation ISaGRAF Workbench software versions 6.0 through 6.6.9 are affected by a Deserialization of Untrusted Data vulnerability.CVE-2022-246519.8sentcms 4.0.x allows remote attackers to cause arbitrary file uploads through an unauthorized file upload interface, resulting in PHP code e CVE-2022-246529.8sentcms 4.0.x allows remote attackers to cause arbitrary file uploads through an unauthorized file upload interface, resulting in php code e CVE-2022-246545.4Authenticated stored cross-site scripting (XSS) vulnerability in "Field Server Address" field in INTELBRAS ATA 200 Firmware 74.19.10.21 allo CVE-2022-246557.8A stack overflow vulnerability exists in the upnpd service in Netgear EX6100v1 201.0.2.28, CAX80 2.1.2.6, and DC112A 1.0.0.62, which may lea CVE-2022-246566.1HexoEditor 1.1.8 is affected by Cross Site Scripting (XSS). By putting a common XSS payload in a markdown file, if opened with the app, will CVE-2022-246579.8Goldshell ASIC Miners v2.1.x was discovered to contain hardcoded credentials which allow attackers to remotely connect via the SSH protocol CVE-2022-246597.5Goldshell ASIC Miners v2.2.1 and below was discovered to contain a path traversal vulnerability which allows unauthenticated attackers to re CVE-2022-24669.8It was found that Quarkus 2.10.x does not terminate HTTP requests header context which may lead to unpredictable behavior.