CVE-2026-126489

OpenEMR before 8.5.0 contains a second-order SQL injection vulnerability in the IPPF contraceptive issue feature because issueippfconsave concatenates layoutoptions fieldid values into a REPLACE INTO query as column names. Authenticated administrators can add a malicious fieldid via editlayout.ph...

CVE-2026-126425

OpenEMR before 8.5.0 contains a stored SQL injection vulnerability in which History layout field identifiers saved through editlayout.php, including HIS fields and LBF source-H fields, are placed unvalidated into an INSERT statement for patients without a historydata row. Users with admin/super a...

CVE-2026-126425

OpenEMR versions before 8.5.0 are vulnerable to a stored SQL injection vulnerability. The flaw exists because History layout field identifiers (including HIS fields and LBF source-H fields) saved via edit_layout.php are inserted into an INSERT statement without proper validation for patients lack...

EUVD-2026-125018

OpenEMR before 8.5.0 contains a stored SQL injection vulnerability in which History layout field identifiers saved through editlayout.php, including HIS fields and LBF source-H fields, are placed unvalidated into an INSERT statement for patients without a historydata row. Users with admin/super a...

CVE-2026-126489 OpenEMR before 8.5.0 SQL Injection via IPPF Contraceptive Issue Feature

OpenEMR before 8.5.0 contains a second-order SQL injection vulnerability in the IPPF contraceptive issue feature because issueippfconsave concatenates layoutoptions fieldid values into a REPLACE INTO query as column names. Authenticated administrators can add a malicious fieldid via editlayout.ph...

EUVD-2026-125135

OpenEMR before 8.5.0 contains a second-order SQL injection vulnerability in the IPPF contraceptive issue feature because issueippfconsave concatenates layoutoptions fieldid values into a REPLACE INTO query as column names. Authenticated administrators can add a malicious fieldid via editlayout.ph...

CVE-2026-126489

OpenEMR versions prior to 8.5.0 are vulnerable to a second-order SQL injection in the IPPF contraceptive issue feature. The root cause is that the issue_ippf_con_save function concatenates layout_options field_id values directly into a REPLACE INTO query as column names without proper neutralizat...