CVE-2026-29187_SqlInjectionVulnerabilityOpenEMR7.0.4

CVE-2026-29187 - 新搜索弹出窗口中的SQL注入漏洞 弱点 CWE-89 SQL命令中特殊元素的未正确中性化处理（'SQL注入'） 产品使用来自上游组件的外界影响输入来构建SQL命令的全部或部分，但未能正确中性化或错误中性化可能改变预期SQL命令的特殊元素。如果没有对用户可控输入中的SQL语法进行充分的移除或转义，生成的SQL查询可能导致这些输入被解释为SQL而非普通用户数据。在MITRE上了解更多。 摘要 OpenEMR $value if !strstartswithstring $key, 'mf' continue; // "match field" $fldnam...

📄 OpenEMR 8.0.0.2 SQL Injection

OpenEMR versions prior to 8.0.0.3 contain a remote SQL injection vulnerability in the new search popup that can be exploited by authenticated attackers. The vulnerability exists due to insufficient input validation in the new search popup functionality. CVE-2026-29187 - SQL Injection Vulnerabilit...

CVE-2026-29187 OpenEMR Vulnerable to Authenticated Blind Boolean-Based SQL Injection in new_search_popup.php

OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 8.0.0.3, a Blind SQL Injection vulnerability exists in the Patient Search functionality /interface/new/newsearchpopup.php. The vulnerability allows an authenticated attacker t...

CVE-2026-29187

OpenEMR has an authenticated blind boolean-based SQL injection vulnerability in the Patient Search feature (/interface/new/new_search_popup.php) present before version 8.0.0.3. The flaw allows an attacker to influence SQL logic by manipulating HTTP parameter keys, enabling arbitrary SQL commands....

CVE-2026-29187 OpenEMR Vulnerable to Authenticated Blind Boolean-Based SQL Injection in new_search_popup.php

OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 8.0.0.3, a Blind SQL Injection vulnerability exists in the Patient Search functionality /interface/new/newsearchpopup.php. The vulnerability allows an authenticated attacker t...