CVE-2022-25471

An Insecure Direct Object Reference (IDOR) vulnerability in OpenEMR 6.0.0 allows any authenticated attacker to access and modify unauthorized areas via a crafted POST request to /modules/zend_modules/public/Installer/register.

• CWE-639

• https://github.com/openemr/openemrProduct, Third Party Advisory
• https://securityforeveryone.com/blog/inactive-post-test/openemr-0-day-idor-vulnerabilityNot Applicable
• https://www.open-emr.org/Vendor Advisory
• https://github.com/openemr/openemrProduct, Third Party Advisory
• https://securityforeveryone.com/blog/inactive-post-test/openemr-0-day-idor-vulnerabilityNot Applicable
• https://www.open-emr.org/Vendor Advisory

Published

Mar 3, 2022

Last Modified

Jun 17, 2026

Status

Modified

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-25460Tenda AC6 v15.03.05.09_multi was discovered to contain a sta…9.8
• CVE-2022-25461Tenda AC6 v15.03.05.09_multi was discovered to contain a sta…9.8
• CVE-2022-25462Yafu v2.0 contains a segmentation fault via the component /f…7.5
• CVE-2022-25464A stored cross-site scripting (XSS) vulnerability in the com…4.8
• CVE-2022-25465Espruino 2v11 release was discovered to contain a stack buff…7.8
• CVE-2022-2547A crafted HTTP packet without a content-type header can crea…7.5
• CVE-2022-25477Vulnerability in Realtek RtsPer driver for PCIe Card Reader …5.5
• CVE-2022-25478Vulnerability in Realtek RtsPer driver for PCIe Card Reader …7.8
• CVE-2022-25479Vulnerability in Realtek RtsPer driver for PCIe Card Reader …5.5
• CVE-2022-25480Vulnerability in Realtek RtsPer driver for PCIe Card Reader …7.8
• CVE-2022-25481ThinkPHP Framework v5.0.24 was discovered to be configured w…7.5
• CVE-2022-25484tcpprep v4.4.1 has a reachable assertion (assert(l2len > 0))…5.5