HIGH 7.1 NVD
CVE-2026-124444
OpenEMR before 8.4.0 contains a mass assignment vulnerability in the patient portal OnsiteDocument query API that lets request parameters set bitwise criteria f
OpenEMR before 8.4.0 contains a mass assignment vulnerability in the patient portal OnsiteDocument query API that lets request parameters set bitwise criteria filters whose values are placed unquoted into the SQL WHERE clause. Authenticated patient portal users can inject SQL via parameters such as Id_BitwiseAnd to read any database table, including other patients' records and staff password hashes.
References
- https://github.com/openemr/openemr/security/advisories/GHSA-hx8r-g8gw-6g2j
- https://www.vulncheck.com/advisories/openemr-before-8.4.0-sql-injection-via-onsitedocument
This high severity vulnerability with a CVSS score of 7.1 was published on 2026-11-08 via NVD.
vulnfeed aggregates 16937 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.