CVE-2026-126478 · Other
NO FIX YET · SEE WHAT TO DO
OpenEMR before 8.5.0 concatenates the form_icd_codes[] POST array into an unquoted numeric IN() clause without integer validation in the Syndromic Surveillance report. An authenticated user can send quote-free payloads to run blind or UNION-based SQL injection and extract patient health information.
first public Oct 28, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
OpenEMR installations before 8.5.0 that expose the Syndromic Surveillance report to users with login accounts. Exposure depends on the report being reachable by authenticated users, so instances where only trusted staff can log in carry less immediate risk but still need patching. Deployments already on 8.5.0 or later are not affected.
Not affected if no-syndromic-surveillance-report, version-8.5.0-or-later
Who cares healthcare, openemr, php, self-hosted
version.php and compare it with the fixed range.8.5.0 or later (the fixed version named in the NVD range for this CVE).OpenEMR before 8.5.0 contains an SQL injection vulnerability in the Syndromic Surveillance report because the form_icd_codes[] POST array is concatenated into an unquoted numeric IN() clause without integer validation. Authenticated users can submit quote-free payloads that bypass add_escape_custom to perform blind or UNION-based injection and exfiltrate patient health information.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.