CVE-2012-0991

Multiple directory traversal vulnerabilities in OpenEMR 4.1.0 allow remote authenticated users to read arbitrary files via a .. (dot dot) in the formname parameter to (1) contrib/acog/print_form.php; or (2) load_form.php, (3) view_form.php, or (4) trend_form.php in interface/patient_file/encounter.

• CWE-22

• http://archives.neohapsis.com/archives/bugtraq/2012-02/0004.htmlExploit, Patch
• http://osvdb.org/78727
• http://osvdb.org/78728
• http://osvdb.org/78729
• http://osvdb.org/78730
• http://secunia.com/advisories/47781Vendor Advisory
• http://www.open-emr.org/wiki/index.php/OpenEMR_PatchesPatch
• http://www.securityfocus.com/bid/51788Exploit
• https://exchange.xforce.ibmcloud.com/vulnerabilities/72914
• https://www.htbridge.ch/advisory/HTB23069Exploit, Patch
• http://archives.neohapsis.com/archives/bugtraq/2012-02/0004.htmlExploit, Patch
• http://osvdb.org/78727
• http://osvdb.org/78728
• http://osvdb.org/78729
• http://osvdb.org/78730
• http://secunia.com/advisories/47781Vendor Advisory
• http://www.open-emr.org/wiki/index.php/OpenEMR_PatchesPatch
• http://www.securityfocus.com/bid/51788Exploit
• https://exchange.xforce.ibmcloud.com/vulnerabilities/72914
• https://www.htbridge.ch/advisory/HTB23069Exploit, Patch

Published

Feb 7, 2012

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2012-0985Multiple buffer overflows in the Wireless Manager ActiveX co…
• CVE-2012-0986Multiple cross-site scripting (XSS) vulnerabilities in Impre…
• CVE-2012-0987Directory traversal vulnerability in edituser.php in Impress…
• CVE-2012-0988Multiple cross-site scripting (XSS) vulnerabilities in confi…
• CVE-2012-0989Cross-site scripting (XSS) vulnerability in OneOrZero AIMS 2…
• CVE-2012-0990Cross-site request forgery (CSRF) vulnerability in admin/set…
• CVE-2012-0992interface/fax/fax_dispatch.php in OpenEMR 4.1.0 allows remot…
• CVE-2012-0993Eval injection vulnerability in zp-core/zp-extensions/viewer…
• CVE-2012-0994SQL injection vulnerability in the Manage Albums feature in …
• CVE-2012-0995Multiple cross-site scripting (XSS) vulnerabilities in ZENph…
• CVE-2012-0996Multiple directory traversal vulnerabilities in 11in1 1.2.1 …
• CVE-2012-0997Cross-site request forgery (CSRF) vulnerability in admin/ind…