CVE-2026-126492 · Other
NO FIX YET · SEE WHAT TO DO
OpenEMR, an electronic health records system, stores attacker-supplied SQL in a list-item option that a later query concatenates and runs. An authenticated low-privileged user can use this to run SQL against the database.
first public Oct 28, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
OpenEMR installations before 8.5.0 where authenticated users can add list items. The flaw is second-order: the payload is stored through addlistitem.php and executed later when dynamic_finder.php builds a SELECT query. Teams that run OpenEMR for clinics or hospitals should treat it as a patient-data exposure.
Not affected if no-low-privilege-accounts, openemr-8.5.0-or-later
Who cares healthcare, openemr, php, self-hosted
version.php; versions below 8.5.0 are named in the description as affected.library/ajax/addlistitem.php.8.5.0 or later (fixed version named in the description).OpenEMR before 8.5.0 contains a second-order sql injection vulnerability that allows low-privileged authenticated users to store malicious SQL via library/ajax/addlistitem.php. Attackers can persist a SQL fragment in the recent_patient_columns option_id value, which dynamic_finder.php concatenates into a SELECT query and executes as SQL.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.