CVE-2026-126465 · Other
NO FIX YET · SEE WHAT TO DO
OpenEMR, an electronic health records system, has an SQL injection flaw in its patient portal api/onsiteactivityviews endpoint, fixed in version 8.5.0. Any authenticated staff user can inject SQL and read patient health data, staff password hashes, MySQL credentials and API tokens.
first public Oct 27, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Organizations running OpenEMR before 8.5.0 with the patient portal API reachable. Exploitation needs a valid staff account, so exposure depends on who holds staff logins. Deployments already on 8.5.0 or later are not affected.
Not affected if no-staff-accounts-untrusted, openemr-8.5.0-or-later
Who cares healthcare, openemr, php, self-hosted
8.5.0 are affected.api/onsiteactivityviews endpoint are enabled on the deployment.8.5.0 or later.OpenEMR before 8.5.0 contains an SQL injection vulnerability in the patient portal api/onsiteactivityviews endpoint that allows any authenticated staff user to inject SQL through unquoted Id_BitwiseAnd Criteria values. Attackers can close the bitwise parenthesis and append OR or UNION SELECT clauses to read patient PHI, staff password hashes, MySQL authentication strings, and API tokens.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.