PT-2026-21970

CVE-2026-23627

Published

2026-02-25

Updated

2026-02-27

Description by

CVSS 3.1

8.8

High

MetricsAV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions OpenEMR versions prior to 8.0.0

Description OpenEMR is an electronic health records and medical practice management application. A flaw exists in the Immunization module where user-supplied patient id values are directly incorporated into SQL queries without proper sanitization. This allows any authenticated user to execute arbitrary SQL queries, potentially leading to database compromise, unauthorized access to protected health information (PHI), credential theft, and remote code execution.

Recommendations Update to version 8.0.0 or later.

Exploitability

Exploit

Fix

Impacts

Researchers

Pavelkohout396

Simecek

Vendors

Affected products

Weakness enumeration

CWE-89: Improper Neutralization of Special Elements used in an SQL Command (\'SQL Injection\')