https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2022-31496.htmlhttps://patchthecve.com/cve/CVE-2022-31496.htmlWed, 17 Jun 2026 04:45:33 +0000HIGH 8.8: LibreHealth EHR Base 2.0.0 allows incorrect interface/super/manage_site_files.php access.https://patchthecve.com/cve/CVE-2022-31497.htmlhttps://patchthecve.com/cve/CVE-2022-31497.htmlWed, 17 Jun 2026 04:45:34 +0000MEDIUM 6.1: LibreHealth EHR Base 2.0.0 allows interface/main/finder/finder_navigation.php patient XSS.https://patchthecve.com/cve/CVE-2022-31495.htmlhttps://patchthecve.com/cve/CVE-2022-31495.htmlWed, 17 Jun 2026 04:45:33 +0000MEDIUM 6.1: LibreHealth EHR Base 2.0.0 allows gacl/admin/acl_admin.php return_page XSS.https://patchthecve.com/cve/CVE-2022-31494.htmlhttps://patchthecve.com/cve/CVE-2022-31494.htmlWed, 17 Jun 2026 04:45:33 +0000MEDIUM 6.1: LibreHealth EHR Base 2.0.0 allows gacl/admin/acl_admin.php action XSS.https://patchthecve.com/cve/CVE-2022-31498.htmlhttps://patchthecve.com/cve/CVE-2022-31498.htmlWed, 17 Jun 2026 04:45:34 +0000MEDIUM 6.1: LibreHealth EHR Base 2.0.0 allows interface/orders/patient_match_dialog.php key XSS.https://patchthecve.com/cve/CVE-2022-31492.htmlhttps://patchthecve.com/cve/CVE-2022-31492.htmlWed, 17 Jun 2026 04:45:33 +0000MEDIUM 6.1: Cross Site scripting (XSS) vulnerability inLibreHealth EHR Base 2.0.0 via interface/usergroup/usergroup_admin_add.php Username.https://patchthecve.com/cve/CVE-2022-31493.htmlhttps://patchthecve.com/cve/CVE-2022-31493.htmlWed, 17 Jun 2026 04:45:33 +0000MEDIUM 6.1: LibreHealth EHR Base 2.0.0 allows gacl/admin/acl_admin.php acl_id XSS.https://patchthecve.com/cve/CVE-2022-29940.htmlhttps://patchthecve.com/cve/CVE-2022-29940.htmlWed, 17 Jun 2026 04:41:00 +0000MEDIUM 5.4: In LibreHealth EHR 2.0.0, lack of sanitization of the GET parameters formseq and formid in interface\orders\find_order_popup.php leads to multiple cross-site scripting (XSS) vulnerabilities.https://patchthecve.com/cve/CVE-2022-29939.htmlhttps://patchthecve.com/cve/CVE-2022-29939.htmlWed, 17 Jun 2026 04:41:00 +0000MEDIUM 5.4: In LibreHealth EHR 2.0.0, lack of sanitization of the GET parameters debug and InsId in interface\billing\sl_eob_process.php leads to multiple cross-site scripting (XSS) vulnerabilities.https://patchthecve.com/cve/CVE-2022-29938.htmlhttps://patchthecve.com/cve/CVE-2022-29938.htmlWed, 17 Jun 2026 04:40:59 +0000HIGH 8.8: In LibreHealth EHR 2.0.0, lack of sanitization of the GET parameter payment_id in interface\billing\new_payment.php via interface\billing\payment_master.inc.php leads to SQL injection.https://patchthecve.com/cve/CVE-2020-23829.htmlhttps://patchthecve.com/cve/CVE-2020-23829.htmlWed, 17 Jun 2026 03:04:59 +0000HIGH 8.8: interface/new/new_comprehensive_save.php in LibreHealth EHR 2.0.0 suffers from an authenticated file upload vulnerability, allowing remote attackers to achieve remote code execution (RCE) on the hosting webserver by uploading a maliciously crafted image.https://patchthecve.com/cve/CVE-2020-11439.htmlhttps://patchthecve.com/cve/CVE-2020-11439.htmlWed, 17 Jun 2026 02:50:10 +0000HIGH 8.8: LibreHealth EMR v2.0.0 is affected by a Local File Inclusion issue allowing arbitrary PHP to be included and executed within the EMR application.https://patchthecve.com/cve/CVE-2020-11438.htmlhttps://patchthecve.com/cve/CVE-2020-11438.htmlWed, 17 Jun 2026 02:50:10 +0000HIGH 8.8: LibreHealth EMR v2.0.0 is affected by systemic CSRF.https://patchthecve.com/cve/CVE-2020-11437.htmlhttps://patchthecve.com/cve/CVE-2020-11437.htmlWed, 17 Jun 2026 02:50:10 +0000MEDIUM 4.3: LibreHealth EMR v2.0.0 is affected by SQL injection allowing low-privilege authenticated users to enumerate the database.https://patchthecve.com/cve/CVE-2020-11436.htmlhttps://patchthecve.com/cve/CVE-2020-11436.htmlWed, 17 Jun 2026 02:50:10 +0000CRITICAL 9.0: LibreHealth EMR v2.0.0 is vulnerable to XSS that results in the ability to force arbitrary actions on behalf of other users including administrators.