https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sun, 15 Nov 2026 16:54:27 +0000 https://db.gcve.eu/vuln/ghsa-8cqq-q32m-8p3f <p>OpenEMR before 8.5.0 contains a missing authorization vulnerability in trusted-messages-ajax.php that allows any authenticated core user to send Direct messages without the patients/notes permission. Attackers with zero-ACL accounts can submit chosen recipients and message bodies sent via the clinic&#39;s phiMail credentials, impersonating the clinic to deliver fraudulent clinical communications.</p> <p>OpenEMR before 8.5.0 contains a missing authorization vulnerability in trusted-messages-ajax.php that allows any authenticated core user to send Direct messages without the patients/notes permission. Attackers with zero-ACL accounts can submit chosen recipients and message bodies sent via the clinic&#39;s phiMail credentials, impersonating the clinic to deliver fraudulent clinical communications.</p> https://db.gcve.eu/vuln/ghsa-8cqq-q32m-8p3f