CVE-2026-126483

Name of the Vulnerable Software and Affected Versions OpenEMR versions prior to 8.5.0

Description Authenticated report users can manipulate database queries by providing a specially crafted value to the form facility variable at the 'interface/reports/ippf statistics.php' endpoint. This allows attackers to bypass the string literal in the facility id WHERE clause and employ boolean or time-based payloads to extract sensitive information from the database.

Recommendations Update to version 8.5.0 or later. As a temporary mitigation, restrict access to the 'interface/reports/ippf statistics.php' endpoint or avoid using the form facility parameter.