PT-2026-139960

CVE-2026-124444

·

Published

2026-11-08

·

Updated

2026-11-08

Description by

CVSS 3.1
7.1
High
MetricsAV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N
OpenEMR before 8.4.0 contains a mass assignment vulnerability in the patient portal OnsiteDocument query API that lets request parameters set bitwise criteria filters whose values are placed unquoted into the SQL WHERE clause. Authenticated patient portal users can inject SQL via parameters such as Id BitwiseAnd to read any database table, including other patients' records and staff password hashes.
Exploitability
Fix
Impacts
Researchers
Vendors
Affected products
Weakness enumeration
CWE-89: Improper Neutralization of Special Elements used in an SQL Command (\'SQL Injection\')
Related identifiers
CVE-2026-124444
Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com