CVE-2026-126492

OpenEMR before 8.5.0 contains a second-order sql injection vulnerability that allows low-privileged authenticated users to store malicious SQL via library/ajax/addlistitem.php. Attackers can persist a SQL fragment in the recentpatientcolumns optionid value, which dynamicfinder.php concatenates in...

CVE-2026-126488

OpenEMR before 8.5.0 contains an SQL injection vulnerability in the patient portal OnsiteDocument.Query endpoint, where mass-assigned BitwiseAnd criteria parameters are placed unquoted into SQL with only quote-character escaping. Authenticated portal patients can inject SQL outside their...

CVE-2026-126484

OpenEMR before 8.5.0 contains a stored cross-site scripting vulnerability in printedfeesheet.php that allows authenticated portal patients to inject script by setting unescaped appointment comments pchometext. Attackers can submit HTML payloads via the formcomments field in addediteventuser.php...

CVE-2026-126480

OpenEMR before 8.5.0 contains an sql injection vulnerability in CcrTable::insertApprovedData that allows authenticated users to inject SQL through request parameter names used as column names. Attackers can send crafted patientdata--sel parameters to the revandapprove route, lacking ACL and CSRF...

CVE-2026-126476

OpenEMR before 8.5.0 contains a reflected cross-site scripting vulnerability in the Application module's auto-suggest endpoint, which echoes the searchMode POST parameter unencoded into a single-quoted onClick attribute. Attackers can induce an authenticated user to submit a single-quote payload ...

CVE-2026-126472

OpenEMR before 8.5.0 contains a missing authorization vulnerability in ccdaservice/ccdagateway.php that allows any authenticated low-privilege staff user to retrieve other patients' C-CDA documents. Attackers can request the view or dl action with sequential pid values and their own CSRF token to...

CVE-2026-126464

OpenEMR before 8.5.0 contains a server-side request forgery vulnerability in PatientPortalPDFDocumentCreator::createPdfObject that allows authenticated patients to make the server issue HTTP GET requests. Attackers can submit img src, inline style url, or reinserted unpurified style blocks via th...

CVE-2026-126468

OpenEMR before 8.5.0 contains a missing authorization vulnerability that allows any authenticated low-privilege user to access reports, dated reminders, and batch reminder endpoints lacking AclMain::aclCheckCore checks. Attackers can request patientlist.php, amcfullreport.php,...

CVE-2026-126460

OpenEMR before 8.5.0 contains a persistent SQL injection vulnerability in SLEOB::slInvoiceNumber, where the CLP01 claim control number from uploaded X12 835 ERA files is concatenated unescaped into a query. Attackers with billing write access can upload a crafted .edi file via sleobsearch.php tha...

CVE-2026-126455

OpenEMR before 8.5.0 contains multiple missing authorization and SQL injection defects across report, portal, transaction, and immunization components. Low-privileged Front Office clerks can chain these to read arbitrary database tables including userssecure hashes, hijack patient portal...

CVE-2026-126451

OpenEMR before 8.5.0 contains a stored cross-site scripting vulnerability that allows portal patients to run JavaScript in staff sessions by injecting javascript: URLs into document templatedata. Attackers can submit an encounterForm value rendered unsanitized into an iframe src by...

CVE-2026-126447

OpenEMR before 8.5.0 contains a missing authorization vulnerability in trusted-messages-ajax.php that allows any authenticated core user to send Direct messages without the patients/notes permission. Attackers with zero-ACL accounts can submit chosen recipients and message bodies sent via the...

CVE-2026-126443

OpenEMR before 8.5.0 contains a missing authorization vulnerability in dynamicfinderajax.php that allows authenticated users without patients/demo permission to query patient demographics. Attackers can supply arbitrary patientdata columns via the sColumns parameter to enumerate names, dates of...

CVE-2026-126439

OpenEMR before 8.5.0 contains a missing authorization vulnerability in ccdaservice/ccdagateway.php that fails to enforce the patients/patrep permission, accepting any authenticated core session. Authenticated users without patient-report permission can request the reportccdview action to retrieve...

CVE-2026-126435

OpenEMR before 8.5.0 contains an improper authorization vulnerability in interface/orders/ordermanifest.php, which checks patients/med without requiring write access or applying patient squad restrictions. Users with only patients/med view permission can request any order ID to read...

CVE-2026-126431

OpenEMR before 8.5.0 contains a second-order sql injection vulnerability that allows authenticated Carecoordination users to store malicious C-CDA field identifiers through the savedata action. Attackers can inject SQL into the IN clause built by fetchFormValues during C-CDA generation to extract...

CVE-2026-126427

OpenEMR before 8.5.0 contains a session expiration vulnerability that prevents automatic logoff because the Eye Exam form's read-only poll omits skiptimeoutreset. Attackers with physical access to an unattended workstation can use the still-active session to view patient health information, since...

CVE-2026-126423

OpenEMR before 8.5.0 contains a denial of service vulnerability in four ZIP upload paths that read uncompressed entries into memory without size or ratio checks. Authenticated billing or Carecoordination users can upload highly compressed ZIP archives to exhaust PHP memory and worker pools, makin...

CVE-2026-126419

OpenEMR before 8.5.0 contains a missing authorization vulnerability in the esignformsubmit handler of library/ESign/Form/Controller.php that verifies only the caller's password, not access to the patient, encounter, or form type. Authenticated core users can supply arbitrary formId, formDir, and...

CVE-2026-126415

OpenEMR before 8.5.0 contains a missing authorization vulnerability in the Patient Validation module that allows any authenticated user to retrieve patient demographic records. Attackers can send direct requests with wildcard mflname or empty mf parameters to the patientvalidation endpoint to...