CVE-2026-126488

OpenEMR versions before 8.5.0 are vulnerable to an SQL injection in the patient portal OnsiteDocument.Query endpoint. The root cause is that mass-assigned _BitwiseAnd criteria parameters are inserted into SQL queries unquoted, using only quote-character escaping. This allows authenticated portal ...