CVE-2026-124469Critical· 9.9▾ MidnightOpenEMR before 8.3.0 contains an SQL injection vulnerability in the Fee Sheet drug-inventory lookup (DrugSalesService::sellDrug) that interpolates the prod[N][warehouse] POST field into an ORDER BY clause. Low-privileged authenticated us…
▾ Midnight zone — Critical, or high with PoC / in-the-wild
impact 54.5 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
OpenEMR before 8.3.0 contains an SQL injection vulnerability in the Fee Sheet drug-inventory lookup (DrugSalesService::sellDrug) that interpolates the prod[N][warehouse] POST field into an ORDER BY clause. Low-privileged authenticated users can submit Fee Sheet product lines with constant subqueries to run a time-based blind oracle, extracting patient data and users_secure bcrypt hashes.
openemr < 8.3.0Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-124444High· 7.1OpenEMR before 8.4.0 SQL Injection via OnsiteDocument Query API
CVE-2026-124468High· 7.1OpenEMR before 8.3.0 SQL Injection via Patient Insurance and Employer REST API
CVE-2026-49142High· 8.8OpenEMR Before 8.5.0 SQL Injection via form_icd_codes[]
CVE-2026-124445Critical· 9.8OpenEMR 7.0.1 before 8.4.0 OneTimeAuth Token Replay and PIN Brute Force
CVE-2026-124446High· 8.8OpenEMR before 8.3.0 Arbitrary File Read and Write via FaxSMS disposeDocument
CVE-2026-124456High· 7.1OpenEMR before 8.3.0 Missing Authorization and IDOR in Prior-Authorizations Module