7 matches found
CVE-2026-126482
OpenEMR before 8.5.0 contains an SQL injection vulnerability in SLEOB::slInvoiceNumber in src/Billing/SLEOB.php, which concatenates the CLP01 claim identifier from uploaded X12 835 ERA files into a query without escaping or parameter binding. Authenticated users with billing permissions, or a...
CVE-2026-126460
OpenEMR before 8.5.0 contains a persistent SQL injection vulnerability in SLEOB::slInvoiceNumber, where the CLP01 claim control number from uploaded X12 835 ERA files is concatenated unescaped into a query. Attackers with billing write access can upload a crafted .edi file via sleobsearch.php tha...
CVE-2026-126460
OpenEMR versions before 8.5.0 are vulnerable to a persistent SQL injection within the SLEOB::slInvoiceNumber() function. The root cause is the unescaped concatenation of the CLP01 claim control number from uploaded X12 835 ERA files into a database query. An attacker with billing write access can...
CVE-2026-126460 OpenEMR before 8.5.0 Persistent SQL Injection via ERA File Reprocessing
OpenEMR before 8.5.0 contains a persistent SQL injection vulnerability in SLEOB::slInvoiceNumber, where the CLP01 claim control number from uploaded X12 835 ERA files is concatenated unescaped into a query. Attackers with billing write access can upload a crafted .edi file via sleobsearch.php tha...
EUVD-2026-124964
OpenEMR before 8.5.0 contains a persistent SQL injection vulnerability in SLEOB::slInvoiceNumber, where the CLP01 claim control number from uploaded X12 835 ERA files is concatenated unescaped into a query. Attackers with billing write access can upload a crafted .edi file via sleobsearch.php tha...
CVE-2026-126482
OpenEMR versions before 8.5.0 are vulnerable to an SQL injection in the SLEOB::slInvoiceNumber() function located in src/Billing/SLEOB.php. The root cause is the lack of escaping or parameter binding when the application concatenates the CLP01 claim identifier from uploaded X12 835 ERA files into...
EUVD-2026-124942
OpenEMR before 8.5.0 contains an SQL injection vulnerability in SLEOB::slInvoiceNumber in src/Billing/SLEOB.php, which concatenates the CLP01 claim identifier from uploaded X12 835 ERA files into a query without escaping or parameter binding. Authenticated users with billing permissions, or a...