CVE-2026-33910

Katalog CVE

CVSS 8.8 · High EPSS 0,64%

Kerentanan Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') pada open-emr openemr. Skor CVSS 3.1 8.8 (High) menurut NVD.

Deskripsi (NVD)

OpenEMR is a free and open source electronic health records and medical practice management application. Versions up to and including 8.0.0.2 contain a SQL injection vulnerability in the patient selection feature that can be exploited by authenticated attackers. The vulnerability exists due to insufficient input validation in the patient selection feature. Version 8.0.0.3 contains a patch.

Rincian

Terbit di NVD

25 Maret 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

8.8 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

EPSS (30 hari)

0,64% peluang dieksploitasi; lebih tinggi dari 49,0% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/openemr/openemr/security/advisories/GHSA-x32c-xj5g-7jx7 exploit · advisory vendor
• https://github.com/openemr/openemr/commit/73db3264aed253684532839380cae3b0a56c83d2 patch
• https://github.com/openemr/openemr/releases/tag/v8_0_0_3 product