Analysis
Analysis and contextual insights are available on OpenCVE Cloud.
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | |||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|
| openemr | openemr | unaffected |
|
No data.
No data.
No data available yet.
No vendor fix or workaround currently provided.
Additional remediation guidance may be available on OpenCVE Cloud.
Tracking
Sign in to view the affected projects.
No advisories yet.
Sun, 08 Nov 2026 13:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | OpenEMR before 8.3.0 contains an SQL injection vulnerability in the Standard REST API patient insurance and employer search, which concatenates query-string parameter names into SQL as column identifiers without escaping. Authenticated clients, including low-privilege patient-portal OAuth2 tokens, can send crafted parameter names to /api/patient/{puuid}/insurance or /api/patient/{puuid}/employer to extract patient PHI, user records, and API client secrets. | |
| Title | OpenEMR before 8.3.0 SQL Injection via Patient Insurance and Employer REST API | |
| First Time appeared |
Open-emr
Open-emr openemr |
|
| Weaknesses | CWE-89 | |
| CPEs | cpe:2.3:a:open-emr:openemr:*:*:*:*:*:*:*:* | |
| Vendors & Products |
Open-emr
Open-emr openemr |
|
| References |
| |
| Metrics |
cvssV3_1
|
MITRE
Status: PUBLISHED
Assigner: VulnCheck
Published:
Updated: 2026-11-08T13:15:52.597Z
Reserved: 2026-11-08T02:16:30.558Z
Link: CVE-2026-124468
Vulnrichment
No data.
NVD
Status : Received
Published: 2026-11-08T14:18:14.977
Modified: 2026-11-08T14:18:14.977
Link: CVE-2026-124468
Redhat
No data.
OpenCVE Enrichment
No data.
-
CWE-89
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')