CVE-2018-15139

Unrestricted file upload in interface/super/manage_site_files.php in versions of OpenEMR before 5.0.1.4 allows a remote authenticated attacker to execute arbitrary PHP code by uploading a file with a PHP extension via the images upload form and accessing it in the images directory.

• CWE-434

• http://packetstormsecurity.com/files/163110/OpenEMR-5.0.1.3-Shell-Upload.htmlExploit, Third Party Advisory, VDB Entry
• http://packetstormsecurity.com/files/163482/OpenEMR-5.0.1.3-Shell-Upload.htmlExploit, Third Party Advisory, VDB Entry
• https://github.com/Hacker5preme/Exploits/tree/main/CVE-2018-15139-ExploitExploit, Third Party Advisory
• https://github.com/openemr/openemr/pull/1757/commits/c2808a0493243f618bbbb3459af23c7da3dc5485Patch, Third Party Advisory
• https://www.databreaches.net/openemr-patches-serious-vulnerabilities-uncovered-by-project-insecurity/Exploit, Third Party Advisory
• http://packetstormsecurity.com/files/163110/OpenEMR-5.0.1.3-Shell-Upload.htmlExploit, Third Party Advisory, VDB Entry
• http://packetstormsecurity.com/files/163482/OpenEMR-5.0.1.3-Shell-Upload.htmlExploit, Third Party Advisory, VDB Entry
• https://github.com/Hacker5preme/Exploits/tree/main/CVE-2018-15139-ExploitExploit, Third Party Advisory
• https://github.com/openemr/openemr/pull/1757/commits/c2808a0493243f618bbbb3459af23c7da3dc5485Patch, Third Party Advisory
• https://www.databreaches.net/openemr-patches-serious-vulnerabilities-uncovered-by-project-insecurity/Exploit, Third Party Advisory

Published

Aug 13, 2018

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2018-15131An issue was discovered in Synacor Zimbra Collaboration Suit…
• CVE-2018-15132An issue was discovered in ext/standard/link_win32.c in PHP …
• CVE-2018-15133In Laravel Framework through 5.5.40 and 5.6.x through 5.6.29…8.1
• CVE-2018-15136TitanHQ SpamTitan before 7.01 has Improper input validation.…
• CVE-2018-15137CeLa Link CLR-M20 devices allow unauthorized users to upload…
• CVE-2018-15138Ericsson-LG iPECS NMS 30M allows directory traversal via ipe…
• CVE-2018-1514IBM Robotic Process Automation with Automation Anywhere 10.0…4.3
• CVE-2018-15140Directory traversal in portal/import_template.php in version…
• CVE-2018-15141Directory traversal in portal/import_template.php in version…
• CVE-2018-15142Directory traversal in portal/import_template.php in version…
• CVE-2018-15143Multiple SQL injection vulnerabilities in portal/find_appt_p…
• CVE-2018-15144SQL injection vulnerability in interface/de_identification_f…