CVE-2026-124444

OpenEMR versions before 8.4.0 are susceptible to a SQL Injection vulnerability within the patient portal OnsiteDocument query API . The root cause is a mass assignment flaw where request parameters used for bitwise criteria filters are inserted unquoted into the SQL WHERE clause . This allows aut...