CVE-2026-126425

OpenEMR before 8.5.0 contains a stored SQL injection vulnerability in which History layout field identifiers saved through edit layout.php, including HIS fields and LBF source-H fields, are placed unvalidated into an INSERT statement for patients without a history data row. Users with admin/super and patients/med write access can trigger history save.php or LBF saves to execute SQL functions like SLEEP, tying up database workers or accessing data beyond their privileges.