CVE-2026-124444High· 7.1▾ TwilightOpenEMR before 8.4.0 contains a mass assignment vulnerability in the patient portal OnsiteDocument query API that lets request parameters set bitwise criteria filters whose values are placed unquoted into the SQL WHERE clause. Authentica…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 39.1 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
OpenEMR before 8.4.0 contains a mass assignment vulnerability in the patient portal OnsiteDocument query API that lets request parameters set bitwise criteria filters whose values are placed unquoted into the SQL WHERE clause. Authenticated patient portal users can inject SQL via parameters such as Id_BitwiseAnd to read any database table, including other patients' records and staff password hashes.
openemr < 8.4.0Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-124469Critical· 9.9OpenEMR before 8.3.0 SQL Injection via Fee Sheet warehouse parameter
CVE-2026-124468High· 7.1OpenEMR before 8.3.0 SQL Injection via Patient Insurance and Employer REST API
CVE-2026-49142High· 8.8OpenEMR Before 8.5.0 SQL Injection via form_icd_codes[]
CVE-2026-124445Critical· 9.8OpenEMR 7.0.1 before 8.4.0 OneTimeAuth Token Replay and PIN Brute Force
CVE-2026-124446High· 8.8OpenEMR before 8.3.0 Arbitrary File Read and Write via FaxSMS disposeDocument
CVE-2026-124456High· 7.1OpenEMR before 8.3.0 Missing Authorization and IDOR in Prior-Authorizations Module