CVE-2026-126463 · Runtime
NO FIX YET · SEE WHAT TO DO
OpenEMR, an electronic health records system, has several SQL injection flaws reachable through ERA CLP01, form_facility, form_icd_codes and POST key names. An authenticated user can read password hashes and patient health information and overwrite patient records.
first public Oct 28, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Any OpenEMR instance before 8.5.0 is exposed to users who can log in, since the injection points sit behind authentication. Instances where only trusted staff have accounts carry less risk but still expose patient data to those users. Instances on a patched version can skip this.
Not affected if no-user-accounts-exposed, version-8.5.0-or-later
Who cares healthcare, openemr, php, self-hosted
unknown if the sources do not say where.8.5.0 or laterOpenEMR before 8.5.0 contains multiple sql injection vulnerabilities that allow authenticated users to inject payloads through ERA CLP01, form_facility, form_icd_codes, and POST key names. Attackers can perform UNION, blind, and error-based injection to read users_secure password hashes and patient PHI, and overwrite patient_data fields.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.