CVE-2018-15152 — Authentication bypass vulnerability in portal/account/register.php in versions of OpenEMR before 5.0.1.4 allows a remote attacker to access (1) portal/add_edit_event_user.php, (2) portal/find_appt_popup_user.php, (3) portal/get_allergies.php, (4) portal/get_amendments.php, (5) portal/get_lab_results.php, (6) portal/get_medications.php, (7) portal/get_patient_documents.php, (8) portal/get_problems.php, (9) portal/get_profile.php, (10) portal/portal_payment.php, (11) portal/messaging/messages.php, (12) portal/messaging/secure_chat.php, (13) portal/report/pat_ledger.php, (14) portal/report/portal_custom_report.php, or (15) portal/report/portal_patient_report.php without authenticating as a patient

Back Back to CVE browser

CRITICAL

Authentication bypass vulnerability in portal/account/register.php in versions of OpenEMR before 5.0.1.4 allows a remote attacker to access (1) portal/add_edit_event_user.php, (2) portal/find_appt_popup_user.php, (3) portal/get_allergies.php, (4) portal/get_amendments.php, (5) portal/get_lab_results.php, (6) portal/get_medications.php, (7) portal/get_patient_documents.php, (8) portal/get_problems.php, (9) portal/get_profile.php, (10) portal/portal_payment.php, (11) portal/messaging/messages.php, (12) portal/messaging/secure_chat.php, (13) portal/report/pat_ledger.php, (14) portal/report/portal_custom_report.php, or (15) portal/report/portal_patient_report.php without authenticating as a patient

Published Aug 15, 2018

9.1

CRITICAL

CVSS 3.1

EPSS 25.94%

Description

Authentication bypass vulnerability in portal/account/register.php in versions of OpenEMR before 5.0.1.4 allows a remote attacker to access (1) portal/add_edit_event_user.php, (2) portal/find_appt_popup_user.php, (3) portal/get_allergies.php, (4) portal/get_amendments.php, (5) portal/get_lab_results.php, (6) portal/get_medications.php, (7) portal/get_patient_documents.php, (8) portal/get_problems.php, (9) portal/get_profile.php, (10) portal/portal_payment.php, (11) portal/messaging/messages.php, (12) portal/messaging/secure_chat.php, (13) portal/report/pat_ledger.php, (14) portal/report/portal_custom_report.php, or (15) portal/report/portal_patient_report.php without authenticating as a patient.

Affected products

Remediation

No remediation recorded yet.

Metrics

25.94% 0.25935

Estimated probability of exploitation in the wild in the next 30 days (FIRST EPSS). As of Oct 1, 2026.

EPSS probability 0.25935

Score over time

2021–2026

EPSS v1
EPSS v2
EPSS v3
EPSS v4
EPSS v5

Percentile over time

EPSS v1
EPSS v2
EPSS v3
EPSS v4
EPSS v5

Table of values (34 key points)

Flat stretches are collapsed; showing up to 120 newest points.

Date	Score	Percentile	Model
Oct 1, 2026	25.94% (0.25935)	97.92th	v5 (v2026.06.15)
Jun 15, 2026	25.94% (0.25935)	97.71th	v5 (v2026.06.15)
Feb 3, 2026	9.06% (0.09059)	92.47th	v4 (v2025.03.14)
Jan 15, 2026	12.04% (0.12037)	93.56th	v4 (v2025.03.14)
Nov 21, 2025	9.06% (0.09059)	92.31th	v4 (v2025.03.14)
Nov 18, 2025	5.80% (0.05804)	89.58th	v4 (v2025.03.14)
Mar 30, 2025	8.63% (0.08626)	91.61th	v4 (v2025.03.14)
Mar 29, 2025	25.08% (0.25076)	93.83th	v4 (v2025.03.14)
Mar 24, 2025	8.63% (0.08626)	91.62th	v4 (v2025.03.14)
Mar 23, 2025	14.54% (0.14543)	93.56th	v4 (v2025.03.14)
Mar 17, 2025	8.63% (0.08626)	91.79th	v4 (v2025.03.14)
Dec 12, 2024	3.01% (0.03009)	91.29th	v3 (v2023.03.01)
Nov 18, 2024	3.01% (0.03009)	91.25th	v3 (v2023.03.01)
Jan 6, 2024	4.20% (0.04202)	91.33th	v3 (v2023.03.01)
Nov 24, 2023	4.26% (0.04261)	91.35th	v3 (v2023.03.01)
Aug 27, 2023	5.91% (0.05912)	92.48th	v3 (v2023.03.01)
Aug 9, 2023	8.13% (0.08127)	93.46th	v3 (v2023.03.01)
Jul 25, 2023	9.26% (0.09258)	93.86th	v3 (v2023.03.01)
Jul 7, 2023	9.47% (0.09469)	93.89th	v3 (v2023.03.01)
Jun 5, 2023	12.04% (0.12039)	94.50th	v3 (v2023.03.01)
Apr 12, 2023	14.11% (0.14106)	94.82th	v3 (v2023.03.01)
Mar 7, 2023	14.33% (0.14326)	94.81th	v3 (v2023.03.01)
Mar 6, 2023	10.21% (0.10212)	94.60th	v2 (v2022.01.01)
Nov 15, 2022	10.21% (0.10212)	94.46th	v2 (v2022.01.01)
Jul 15, 2022	1.32% (0.01319)	70.11th	v2 (v2022.01.01)
Apr 1, 2022	10.21% (0.10212)	94.14th	v2 (v2022.01.01)
Feb 4, 2022	10.21% (0.10212)	87.64th	v2 (v2022.01.01)
Feb 3, 2022	7.69% (0.07689)	84.25th	v1
Jan 29, 2022	7.69% (0.07689)	84.23th	v1
Jan 6, 2022	6.66% (0.06657)	83.00th	v1
Sep 1, 2021	6.66% (0.06657)	90.67th	v1
Jun 19, 2021	6.66% (0.06657)	0.00th	v1
Jun 17, 2021	5.60% (0.05603)	0.00th	v1
Apr 14, 2021	1.31% (0.01306)	0.00th	v1

Weaknesses (1)

CWE-287

Improper Authentication

References (6)

http://packetstormsecurity.com/files/163181/OpenEMR-5.0.1.3-Authentication-Bypass.html
x_refsource_MISCExploitThird Party AdvisoryVDB Entry
https://github.com/Hacker5preme/Exploits/tree/main/CVE-2018-15152-Exploit
x_refsource_MISCExploitThird Party Advisory
https://github.com/openemr/openemr/pull/1758/files
x_refsource_CONFIRMPatchThird Party Advisory
https://insecurity.sh/reports/openemr.pdf
x_refsource_MISCURL Repurposed
https://www.databreaches.net/openemr-patches-serious-vulnerabilities-uncovered-by-project-insecurity/
x_refsource_MISCExploitThird Party Advisory
https://www.open-emr.org/wiki/index.php/OpenEMR_Patches
x_refsource_CONFIRMPatchRelease NotesVendor Advisory

Link	Providers	Tags
http://packetstormsecurity.com/files/163181/OpenEMR-5.0.1.3-Authentication-Bypass.html		x_refsource_MISCExploitThird Party AdvisoryVDB Entry
https://github.com/Hacker5preme/Exploits/tree/main/CVE-2018-15152-Exploit		x_refsource_MISCExploitThird Party Advisory
https://github.com/openemr/openemr/pull/1758/files		x_refsource_CONFIRMPatchThird Party Advisory
https://insecurity.sh/reports/openemr.pdf		x_refsource_MISCURL Repurposed
https://www.databreaches.net/openemr-patches-serious-vulnerabilities-uncovered-by-project-insecurity/		x_refsource_MISCExploitThird Party Advisory
https://www.open-emr.org/wiki/index.php/OpenEMR_Patches		x_refsource_CONFIRMPatchRelease NotesVendor Advisory