Security researchers at AISLE discovered 38 vulnerabilities in OpenEMR, widely-used healthcare software serving approximately 100,000 medical providers. The flaws range from critical to moderate severity and could expose patient data and system integrity.
AISLE's security research team identified the vulnerabilities through comprehensive testing of OpenEMR, an open-source electronic medical records platform deployed across hospitals, clinics, and private practices globally.
The discovered CVEs span multiple attack vectors including authentication bypass, SQL injection, cross-site scripting (XSS), and privilege escalation vulnerabilities. Critical-severity issues could allow unauthenticated attackers to access sensitive patient information or compromise system functionality without administrative credentials.
OpenEMR's widespread adoption in healthcare settings amplifies the risk surface. The software handles Protected Health Information (PHI) including patient medical histories, contact details, insurance information, and treatment records. Exploitation of these vulnerabilities could result in data breaches, regulatory violations under HIPAA, and operational disruptions at healthcare facilities.
AISLE disclosed findings to OpenEMR maintainers through responsible disclosure protocols. The research team provided detailed technical documentation and proof-of-concept demonstrations to facilitate patch development.
The discovery underscores persistent security challenges in open-source healthcare software. While open-source models enable transparency and community contribution, resource constraints often limit security auditing compared to proprietary alternatives. Healthcare organizations using OpenEMR should prioritize updating to patched versions once available and implement network segmentation to restrict access to medical records systems.
OpenEMR project maintainers typically release patches following vulnerability disclosure. Organizations are advised to monitor official channels for security updates and apply fixes according to established patch management procedures.
This disclosure adds to ongoing concerns about cybersecurity in healthcare infrastructure. Recent years have seen escalating ransomware attacks targeting hospitals and medical providers, making software security validation increasingly critical for healthcare IT decision-makers.
The full vulnerability report is available on AISLE's research blog with technical details available to security professionals.
Manchester Airports Group disclosed a breach affecting Manchester, Stansted, and East Midlands airports. Hackers accessed data from approximately 8.7 million customers.
A lawsuit alleges that Elon Musk's xAI trained its Grok language models using child sexual abuse material, including both real and AI-generated imagery.
The ShinyHunters extortion group has published sensitive data from nearly 13 million Carhartt customer accounts stolen earlier this month, according to data breach notification service Have I Been Pwned.
A Russian-speaking ransomware gang called Aur0ra exploited SpaceX's Cursor AI coding assistant to breach at least seven companies between mid-April and late May, according to security firm Gambit Security.