VulnerabilityAnalyzed

CVE-2026-33910

Versions up to and including 8.0.0.2 contain a SQL injection vulnerability in the patient selection feature that can be exploited by authenticated attackers.

HIGH 8.8EPSS 0.43%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (0.43%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

OpenEMR is a free and open source electronic health records and medical practice management application. Versions up to and including 8.0.0.2 contain a SQL injection vulnerability in the patient selection feature that can be exploited by authenticated attackers. The vulnerability exists due to insufficient input validation in the patient selection feature. Version 8.0.0.3 contains a patch.

CVSS 3.1: 8.8 HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS: 0.43% probability · 36th percentile
CISA KEV: Not listed
Weakness: CWE-89
Affected: open-emr/openemr
Source: security-advisories@github.com

References

https://github.com/openemr/openemr/commit/73db3264aed253684532839380cae3b0a56c83d2Patch
https://github.com/openemr/openemr/releases/tag/v8_0_0_3Product
https://github.com/openemr/openemr/security/advisories/GHSA-x32c-xj5g-7jx7Exploit, Vendor Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.