CVE-2026-67610 OpenEMR 8.2.0 OAuth2 Dynamic Client Registration Unauthorized FHIR Access

OpenEMR through 8.2.0 contains an improper authentication vulnerability in the OAuth2 dynamic client registration endpoint that allows unauthenticated attackers to register a malicious client with system-level FHIR scopes by supplying a self-generated RSA keypair via the jwks field. Once an...

CVE-2026-67610

OpenEMR through 8.2.0 contains an improper authentication vulnerability in the OAuth2 dynamic client registration endpoint that allows unauthenticated attackers to register a malicious client with system-level FHIR scopes by supplying a self-generated RSA keypair via the jwks field. Once an...

CVE-2026-67610

OpenEMR 8.2.0 is affected by an improper authentication vulnerability in the OAuth2 dynamic client registration endpoint. Attackers can unauthenticatedly register a malicious client by supplying a self-generated RSA keypair in the jwks field, leveraging system-level FHIR scopes. After an administ...

CVE-2026-67610 OpenEMR 8.2.0 OAuth2 Dynamic Client Registration Unauthorized FHIR Access

OpenEMR through 8.2.0 contains an improper authentication vulnerability in the OAuth2 dynamic client registration endpoint that allows unauthenticated attackers to register a malicious client with system-level FHIR scopes by supplying a self-generated RSA keypair via the jwks field. Once an...

EUVD-2026-52345

OpenEMR through 8.2.0 contains a remote code execution vulnerability in the document category tree component library/classes/Tree.class.php that allows authenticated administrators to execute arbitrary operating system commands by injecting PHP payloads into the categories database table. Attacke...

CVE-2026-39932 OpenEMR 8.2.0 Remote Code Execution via CategoryTree eval() Injection

OpenEMR through 8.2.0 contains a remote code execution vulnerability in the document category tree component library/classes/Tree.class.php that allows authenticated administrators to execute arbitrary operating system commands by injecting PHP payloads into the categories database table. Attacke...

CVE-2026-39932 OpenEMR 8.2.0 Remote Code Execution via CategoryTree eval() Injection

OpenEMR through 8.2.0 contains a remote code execution vulnerability in the document category tree component library/classes/Tree.class.php that allows authenticated administrators to execute arbitrary operating system commands by injecting PHP payloads into the categories database table. Attacke...

CVE-2026-39932

CVE-2026-39932 affects OpenEMR 8.2.0, enabling remote code execution through the document category tree component. The vulnerability arises from an unsanitized eval() in CategoryTree (library/classes/Tree.class.php) that executes PHP payloads injected into the categories table. An authenticated a...

CVE-2026-39932 OpenEMR 8.2.0 Remote Code Execution via CategoryTree eval() Injection

OpenEMR through 8.2.0 contains a remote code execution vulnerability in the document category tree component library/classes/Tree.class.php that allows authenticated administrators to execute arbitrary operating system commands by injecting PHP payloads into the categories database table. Attacke...

CVE-2026-39932

OpenEMR through 8.2.0 contains a remote code execution vulnerability in the document category tree component library/classes/Tree.class.php that allows authenticated administrators to execute arbitrary operating system commands by injecting PHP payloads into the categories database table. Attacke...

CVE-2026-39931

OpenEMR through 8.2.0 contains an authenticated SQL injection vulnerability in the backup configuration import feature that allows administrators with admin or super ACL privileges to execute arbitrary DDL and DML statements against the application database by uploading a crafted SQL file at the...

EUVD-2026-52342

OpenEMR through 8.2.0 contains an authenticated SQL injection vulnerability in the backup configuration import feature that allows administrators with admin or super ACL privileges to execute arbitrary DDL and DML statements against the application database by uploading a crafted SQL file at the...

CVE-2026-39931 OpenEMR Authenticated SQL Injection via backup.php Import Feature

OpenEMR through 8.2.0 contains an authenticated SQL injection vulnerability in the backup configuration import feature that allows administrators with admin or super ACL privileges to execute arbitrary DDL and DML statements against the application database by uploading a crafted SQL file at the...

CVE-2026-39931 OpenEMR Authenticated SQL Injection via backup.php Import Feature

OpenEMR through 8.2.0 contains an authenticated SQL injection vulnerability in the backup configuration import feature that allows administrators with admin or super ACL privileges to execute arbitrary DDL and DML statements against the application database by uploading a crafted SQL file at the...

CVE-2026-39931

OpenEMR

CVE-2026-39931 OpenEMR Authenticated SQL Injection via backup.php Import Feature

OpenEMR through 8.2.0 contains an authenticated SQL injection vulnerability in the backup configuration import feature that allows administrators with admin or super ACL privileges to execute arbitrary DDL and DML statements against the application database by uploading a crafted SQL file at the...

CVE-2026-67610: Missing Authentication for Critical Function

OpenEMR through 8.2.0 contains an improper authentication vulnerability in the OAuth2 dynamic client registration endpoint that allows unauthenticated attackers to register a malicious client with system-level FHIR scopes by supplying a self-generated RSA keypair via the jwks field. Once an...

PT-2026-67440

OpenEMR through 8.2.0 contains an authentication bypass vulnerability that allows attackers with valid credentials to circumvent multi-factor authentication by exploiting the exposed OAuth2 password grant flow through an unauthenticated client registration endpoint. Attackers can register an OAut...

PT-2026-67441

OpenEMR through 8.2.0 contains a stored cross-site scripting vulnerability in the patient portal template system that allows authenticated administrators to inject arbitrary HTML and JavaScript by storing malicious payloads through the template save mode, which only filters literal PHP open tags...

PT-2026-67434

OpenEMR through 8.2.0 contains an authenticated SQL injection vulnerability in the backup configuration import feature that allows administrators with admin or super ACL privileges to execute arbitrary DDL and DML statements against the application database by uploading a crafted SQL file at the...