PT-2026-146716

CVE-2026-126430

Published

2026-11-13

Updated

2026-11-13

Description by

CVSS 3.1

8.1

High

MetricsAV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

OpenEMR before 8.5.0 contains an sql injection vulnerability that allows any authenticated core user to inject SQL by supplying crafted patient data field names to the CCR revandapprove controller. Attackers can embed scalar subqueries in the UPDATE patient data SET clause to read staff password hashes and portal reset values, alter arbitrary patient demographics, and take over patient-portal accounts.

Exploitability

Fix

Impacts

Researchers

Farisv

Sharwinreddy

Sounlabs

Vendors

Affected products

Weakness enumeration

CWE-89: Improper Neutralization of Special Elements used in an SQL Command (\'SQL Injection\')

Related identifiers