CVE-2012-0991

· N/AModified

← All CVEs

CVSS v3.1

N/A

EPSS

11.26%

Published

Feb 7, 2012

Modified

Apr 28, 2026

Public PoC / Exploit (5)

All weaponized →

TrickestTrickest PoC index NucleiNuclei detection template Exploit-DBOpenEMR 4.1 - '/contrib/acog/print_form.php?formname' Traversal Local File Inclusion Exploit-DBOpenEMR 4.1 - '/Interface/patient_file/encounter/load_form.php?formname' Traversal Local File Inclusion Exploit-DBOpenEMR 4.1 - '/Interface/patient_file/encounter/trend_form.php?formname' Traversal Local File Inclusion

Links to public security research (Exploit-DB, Nuclei, Trickest, GitHub) for defensive use only.

Description

Multiple directory traversal vulnerabilities in OpenEMR 4.1.0 allow remote authenticated users to read arbitrary files via a .. (dot dot) in the formname parameter to (1) contrib/acog/print_form.php; or (2) load_form.php, (3) view_form.php, or (4) trend_form.php in interface/patient_file/encounter.

Weaknesses (CWE)

CWE-22

Affected Products (1)

openemr · openemrvulnerable

References (20)

http://archives.neohapsis.com/archives/bugtraq/2012-02/0004.html

ExploitPatch

http://osvdb.org/78727

http://osvdb.org/78728

http://osvdb.org/78729

http://osvdb.org/78730

http://secunia.com/advisories/47781