PT-2026-146711
CVE-2026-126425
·
تاريخ النشر
2026-11-13
·
تاريخ التحديث
2026-11-13
الوصف من
CVSS 3.1
7.2
عاليةالمقاييسAV:N/AC:H/PR:H/UI:N/S:C/C:H/I:L/A:L
OpenEMR before 8.5.0 contains a stored SQL injection vulnerability in which History layout field identifiers saved through edit layout.php, including HIS fields and LBF source-H fields, are placed unvalidated into an INSERT statement for patients without a history data row. Users with admin/super and patients/med write access can trigger history save.php or LBF saves to execute SQL functions like SLEEP, tying up database workers or accessing data beyond their privileges.
وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾