EUVD-2026-119525

OpenEMR before 8.3.0 contains an SQL injection vulnerability in the Fee Sheet drug-inventory lookup DrugSalesService::sellDrug that interpolates the prodNwarehouse POST field into an ORDER BY clause. Low-privileged authenticated users can submit Fee Sheet product lines with constant subqueries to...

CVE-2026-124469 OpenEMR before 8.3.0 SQL Injection via Fee Sheet warehouse parameter

OpenEMR before 8.3.0 contains an SQL injection vulnerability in the Fee Sheet drug-inventory lookup DrugSalesService::sellDrug that interpolates the prodNwarehouse POST field into an ORDER BY clause. Low-privileged authenticated users can submit Fee Sheet product lines with constant subqueries to...

CVE-2026-124469

OpenEMR versions before 8.3.0 are vulnerable to an SQL injection in the Fee Sheet drug-inventory lookup (DrugSalesService::sellDrug ). The flaw exists because the application interpolates the prod[N][warehouse] POST field directly into an ORDER BY clause. This allows low-privileged authenticated ...

CVE-2026-124469: openemr: OpenEMR before 8.3.0 contains an SQL injection vulnerability in the Fee Sheet drug-inventory lookup…

OpenEMR before 8.3.0 contains an SQL injection vulnerability in the Fee Sheet drug-inventory lookup DrugSalesService::sellDrug that interpolates the prodNwarehouse POST field into an ORDER BY clause. Low-privileged authenticated users can submit Fee Sheet product lines with constant subqueries to...

PT-2026-139983

Name of the Vulnerable Software and Affected Versions OpenEMR versions prior to 8.3.0 Description An SQL injection issue exists in the Fee Sheet drug-inventory lookup within the sellDrug function of the DrugSalesService class. The flaw occurs when the prodNwarehouse POST field is interpolated int...