CVE-2026-126465

Name of the Vulnerable Software and Affected Versions OpenEMR versions prior to 8.5.0

Description An SQL injection issue exists in the patient portal 'api/onsiteactivityviews' endpoint. Authenticated staff users can inject SQL commands via unquoted Id BitwiseAnd criteria values. By closing the bitwise parenthesis and appending OR or UNION SELECT clauses, attackers can access patient Protected Health Information (PHI), staff password hashes, MySQL authentication strings, and API tokens.

Recommendations Update to version 8.5.0 or later. As a temporary mitigation, restrict access to the 'api/onsiteactivityviews' endpoint or avoid using the Id BitwiseAnd parameter.