CVE-2026-124468High· 7.1▾ TwilightOpenEMR before 8.3.0 contains an SQL injection vulnerability in the Standard REST API patient insurance and employer search, which concatenates query-string parameter names into SQL as column identifiers without escaping. Authenticated c…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 39.1 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
OpenEMR before 8.3.0 contains an SQL injection vulnerability in the Standard REST API patient insurance and employer search, which concatenates query-string parameter names into SQL as column identifiers without escaping. Authenticated clients, including low-privilege patient-portal OAuth2 tokens, can send crafted parameter names to /api/patient/{puuid}/insurance or /api/patient/{puuid}/employer to extract patient PHI, user records, and API client secrets.
openemr < 8.3.0Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-124444High· 7.1OpenEMR before 8.4.0 SQL Injection via OnsiteDocument Query API
CVE-2026-124469Critical· 9.9OpenEMR before 8.3.0 SQL Injection via Fee Sheet warehouse parameter
CVE-2026-49142High· 8.8OpenEMR Before 8.5.0 SQL Injection via form_icd_codes[]
CVE-2026-124445Critical· 9.8OpenEMR 7.0.1 before 8.4.0 OneTimeAuth Token Replay and PIN Brute Force
CVE-2026-124446High· 8.8OpenEMR before 8.3.0 Arbitrary File Read and Write via FaxSMS disposeDocument
CVE-2026-124456High· 7.1OpenEMR before 8.3.0 Missing Authorization and IDOR in Prior-Authorizations Module