CVE-2026-126489 · Package
NO FIX YET · SEE WHAT TO DO
OpenEMR before 8.5.0 builds a REPLACE INTO query by concatenating layout field_id values as column names, so a crafted field_id is executed as SQL. An authenticated administrator can run arbitrary SQL against the clinic database.
first public Oct 28, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
OpenEMR installations before 8.5.0 that use the IPPF contraceptive issue feature. The attacker must hold an administrator account that can edit layouts, so limit admin accounts and patch to 8.5.0. Sites on a fixed version are not exposed.
Not affected if no-admin-exposure, version-8.5.0-or-later
Who cares healthcare, openemr, php, self-hosted
version.php and compare it with the fixed version.8.5.0 or later.OpenEMR before 8.5.0 contains a second-order SQL injection vulnerability in the IPPF contraceptive issue feature because issue_ippf_con_save concatenates layout_options field_id values into a REPLACE INTO query as column names. Authenticated administrators can add a malicious field_id via edit_layout.php, then trigger issue_ippf_con_save through add_edit_issue.php to execute arbitrary SQL.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.