CVE-2026-126425 · Runtime
NO FIX YET · SEE WHAT TO DO
OpenEMR before 8.5.0 places unvalidated History layout field identifiers into an INSERT statement for patients without a history row. Users with admin or med write access can trigger SQL functions such as SLEEP, tying up database workers or reading data beyond their privileges.
first public Oct 28, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
OpenEMR installations before 8.5.0 are exposed, and the flaw needs a user with admin, super or patients/med write access to trigger it through history_save.php or LBF saves. Teams that run OpenEMR for clinics or hospitals should look at it; the sources do not say whether self-hosted and hosted deployments differ.
Not affected if no-write-access-users, openemr-8.5.0-or-later
Who cares healthcare, openemr, self-hosted, sql
8.5.0 are named as affected.8.5.0 or later.OpenEMR before 8.5.0 contains a stored SQL injection vulnerability in which History layout field identifiers saved through edit_layout.php, including HIS fields and LBF source-H fields, are placed unvalidated into an INSERT statement for patients without a history_data row. Users with admin/super and patients/med write access can trigger history_save.php or LBF saves to execute SQL functions like SLEEP, tying up database workers or accessing data beyond their privileges.
This page as .md · .json · CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.