CVE-2018-15152

CVE-2018-15152 is a critical authentication bypass vulnerability affecting OpenEMR versions prior to 5.0.1.4. This flaw allows an unauthenticated remote attacker to access sensitive patient portal functionalities, including patient records, messaging, and financial information, without needing to log in. Rated with a CVSS score of 9.1 (CRITICAL), the vulnerability has a low attack complexity and requires no user interaction, enabling full compromise of confidentiality and integrity of patient data. The EPSS score indicates a relatively low probability of exploitation in the wild, despite its high severity. While not listed on the CISA KEV catalog or having significant community discussion or media coverage, an exploit for this vulnerability is publicly available on ExploitDB. There is no evidence of active exploitation in the wild, and no Metasploit or Nuclei modules are currently available.