Skip to content
Threat Feed
Subscribe

Tag

Health-Sector

3 briefs RSS
critical advisory

OpenEMR: SQL injection in Fee Sheet drug-inventory lookup (CVE-2026-124469)

OpenEMR versions prior to 8.3.0 are susceptible to time-based blind SQL injection in the Fee Sheet component, allowing low-privileged authenticated users to exfiltrate patient data and user hashes.

OpenEMR web-application sql-injection health-sector
2t 1c
high advisory

OpenEMR: Missing authorization in document upload (CVE-2026-124461)

OpenEMR versions prior to 8.3.0 are susceptible to an authorization bypass vulnerability allowing authenticated users to read and overwrite arbitrary document data via the library/ajax/upload.php script.

OpenEMR web-application-vulnerability authorization-bypass health-sector
1r 1c
high advisory

OpenEMR: Stored cross-site scripting in CCDA/CCD preview (CVE-2026-124448)

OpenEMR versions before 8.3.0 are vulnerable to stored cross-site scripting via maliciously crafted CCDA/CCD document attachments that execute scripts in a clinician's session upon preview.

OpenEMR xss web-application-vulnerability health-sector
1t 1c