CVE-2026-126463

Name of the Vulnerable Software and Affected Versions OpenEMR versions prior to 8.5.0

Description Authenticated users can exploit multiple SQL injection flaws by injecting payloads through the ERA CLP01, form facility, form icd codes, and POST key names. This allows for UNION, blind, and error-based injection techniques to read password hashes from users secure and patient Protected Health Information (PHI), as well as overwrite fields within patient data.

Recommendations Update to version 8.5.0 or later.