Openemr
CVE-2026-126480: OpenEMR before 8.5.0 contains an sql injection vulnerability in CcrTable::insertApprovedData() that allows authenticated users to inject SQL through request par
CVE-2026-126480 Nov 13, 2026 Source: Vendor
OpenEMR before 8.5.0 contains an sql injection vulnerability in CcrTable::insertApprovedData() that allows authenticated users to inject SQL through request parameter names used as column names. Attackers can send crafted patient_data-*-sel parameters to the revandapprove route, lacking ACL and CSRF checks, to copy password hashes into patient fields or corrupt records.
Source of record
The credited names below are quoted verbatim from the vendor's own advisory:
https://nvd.nist.gov/vuln/detail/CVE-2026-126480
Are you credited here? Sign in to claim your line. It is yours immediately, with no review queue. The name the vendor printed stays next to your handle for anyone to check against the advisory above, and any member who thinks a claim is wrong can refute it.
Credited
3 lines
Showing 1–3 of 3
CVE-2026-126480
BR2026-0000-048270
unclaimed
Credited as energytag6
CVE-2026-126480
BR2026-0000-048271
unclaimed
Credited as SounLabs
CVE-2026-126480
BR2026-0000-048272
unclaimed
Credited as farisv