How severe is CVE-2007-0649?

CVE-2007-0649 has a CVSS 2.0 base score of 4.3, rated medium severity.

Is CVE-2007-0649 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 6% (93rd percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2007-0649?

CVE-2007-0649 affects Openemr. See the affected-products list for the exact vulnerable versions.

How do I fix CVE-2007-0649?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

When was CVE-2007-0649 published?

CVE-2007-0649 was published on 2007-02-01 and last updated on 2026-06-16.

CVE-2007-0649

CVE-2007-0649 is a medium-severity vulnerability in Openemr with a CVSS 2.0 base score of 4.3. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-94.

Key facts

Severity: Medium (CVSS 2.0 base score 4.3)
EPSS exploit prediction: 6% (93rd percentile)
Actively exploited: Not listed in CISA KEV
Weakness: CWE-94
Affected product: Openemr
Published: 2007-02-01
Last modified: 2026-06-16

Description

Variable overwrite vulnerability in interface/globals.php in OpenEMR 2.8.2 and earlier allows remote attackers to overwrite arbitrary program variables and conduct other unauthorized activities, such as conduct (a) remote file inclusion attacks via the srcdir parameter in custom/import_xml.php or (b) cross-site scripting (XSS) attacks via the rootdir parameter in interface/login/login_frame.php, via vectors associated with extract operations on the (1) POST and (2) GET superglobal arrays. NOTE: this issue was originally disputed before the extract behavior was identified in post-disclosure analysis. Also, the original report identified "Open Conference Systems," but this was an error.

Frequently asked questions

What is CVE-2007-0649?: Variable overwrite vulnerability in interface/globals.php in OpenEMR 2.8.2 and earlier allows remote attackers to overwrite arbitrary program variables and conduct other unauthorized activities, such as conduct (a) remote file inclusion attacks via the srcdir parameter in custom/import_xml.php or (b) cross-site scripting (XSS) attacks via the rootdir parameter in interface/login/login_frame.php, via vectors associated with extract operations on the (1) POST and (2) GET superglobal arrays. NOTE: this issue was originally disputed before the extract behavior was identified in post-disclosure analysis. Also, the original report identified "Open Conference Systems," but this was an error.
How severe is CVE-2007-0649?: CVE-2007-0649 has a CVSS 2.0 base score of 4.3, rated medium severity.
Is CVE-2007-0649 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 6% (93rd percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2007-0649?: CVE-2007-0649 affects Openemr. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2007-0649?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
When was CVE-2007-0649 published?: CVE-2007-0649 was published on 2007-02-01 and last updated on 2026-06-16.

References

Affected products (1)

cpe:2.3:a:openemr:openemr:*:*:*:*:*:*:*:*

More vulnerabilities in Openemr

CVE-2012-0992 — High (CVSS 8.5): interface/fax/fax_dispatch.php in OpenEMR 4.1.0 allows remote authenticated users to execute arbitrary commands via…
CVE-2006-5795 — High (CVSS 7.5): Multiple PHP remote file inclusion vulnerabilities in OpenEMR 2.8.1 and earlier, when register_globals is enabled,…
CVE-2006-5811 — Medium (CVSS 6.8): PHP remote file inclusion vulnerability in library/translation.inc.php in OpenEMR 2.8.1, with register_globals enabled,…
CVE-2006-2929 — Medium (CVSS 6.8): PHP remote file inclusion vulnerability in contrib/forms/evaluation/C_FormEvaluation.class.php in OpenEMR 2.8.1 and…
CVE-2012-0991 — Low (CVSS 3.5): Multiple directory traversal vulnerabilities in OpenEMR 4.1.0 allow remote authenticated users to read arbitrary files…

All CVEs affecting Openemr →

Other CWE-94 (Code Injection) vulnerabilities

CVE-2026-57624 — Critical (CVSS 10.0): Unauthenticated Remote Code Execution (RCE) in Blocksy Companion Pro <= 2.1.46 versions.
CVE-2026-10134 — Critical (CVSS 10.0): IBM Langflow OSS 1.0.0 through 1.9.3 allows an attacker to read every secret available to the Langflow process, read…
CVE-2026-53576 — Critical (CVSS 10.0): Kestra is an open-source, event-driven orchestration platform. Prior to 1.0.45 and 1.3.21, the authentication filter…
CVE-2026-10561 — Critical (CVSS 10.0): IBM Langflow OSS 1.0.0 through 1.9.3 has an vulnerability due to an improper isolation of Python execution combined…
CVE-2026-25470 — Critical (CVSS 10.0): Improper Control of Generation of Code ('Code Injection') vulnerability in ACPT ACPT (Pro) - Custom Post Types Plugin…
CVE-2026-48836 — Critical (CVSS 10.0): Unauthenticated Remote Code Execution (RCE) in Easy Invoice <= 2.1.19 versions.

Browse all CWE-94 (Code Injection) vulnerabilities →