{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/tags/health-sector/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:open-emr:openemr:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":9.9,"id":"CVE-2026-124469"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["OpenEMR (\u003c 8.3.0)"],"_cs_severities":["critical"],"_cs_tags":["web-application","sql-injection","health-sector"],"_cs_type":"advisory","_cs_vendors":["OpenEMR"],"content_html":"\u003cp\u003eOpenEMR versions before 8.3.0 contain an SQL injection vulnerability in the \u003ccode\u003eDrugSalesService::sellDrug\u003c/code\u003e method. The vulnerability arises from improper sanitization of the \u003ccode\u003eprod[N][warehouse]\u003c/code\u003e POST field before it is used in an \u003ccode\u003eORDER BY\u003c/code\u003e clause. An authenticated attacker with low privileges can leverage this flaw to perform time-based blind SQL injection attacks to exfiltrate sensitive data, such as patient records and bcrypt hashes of user credentials.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows authenticated attackers to perform unauthorized data extraction, leading to the compromise of patient PII and user authentication data (bcrypt hashes).\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade to OpenEMR version 8.3.0 or later to address the vulnerability.\u003c/li\u003e\n\u003cli\u003eAudit access logs for abnormal POST request patterns to the \u003ccode\u003eDrugSalesService\u003c/code\u003e or Fee Sheet-related endpoints containing SQL injection syntax, particularly within the \u003ccode\u003eprod[N][warehouse]\u003c/code\u003e parameter.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-11-08T21:26:25Z","date_published":"2026-11-08T21:26:25Z","id":"https://feed.craftedsignal.io/briefs/2026-11-openemr-sqli/","summary":"OpenEMR versions prior to 8.3.0 are susceptible to time-based blind SQL injection in the Fee Sheet component, allowing low-privileged authenticated users to exfiltrate patient data and user hashes.","title":"OpenEMR: SQL injection in Fee Sheet drug-inventory lookup (CVE-2026-124469)","url":"https://feed.craftedsignal.io/briefs/2026-11-openemr-sqli/"},{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:open-emr:openemr:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":8.1,"id":"CVE-2026-124461"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["OpenEMR (\u003c 8.3.0)"],"_cs_severities":["high"],"_cs_tags":["web-application-vulnerability","authorization-bypass","health-sector"],"_cs_type":"advisory","_cs_vendors":["OpenEMR"],"content_html":"\u003cp\u003eOpenEMR versions prior to 8.3.0 contain a missing authorization vulnerability in 'library/ajax/upload.php'. This flaw permits an authenticated user to perform unauthorized read and write operations on document data by manipulating the 'doc_id' parameter.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows low-privileged users to enumerate document IDs, leading to the unauthorized disclosure of patient health information (PHI) and the potential tampering of medical records across the entire installation.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade OpenEMR to version 8.3.0 or later to remediate the authorization logic flaw.\u003c/li\u003e\n\u003cli\u003eImplement strict access control monitoring for requests directed to 'library/ajax/upload.php'.\u003c/li\u003e\n\u003cli\u003eReview application access logs for abnormal volumes of requests to the document upload endpoint, specifically those targeting sequential or unusual 'doc_id' values.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-11-08T15:34:30Z","date_published":"2026-11-08T15:34:30Z","id":"https://feed.craftedsignal.io/briefs/2026-11-openemr-auth-bypass-a575c508/","summary":"OpenEMR versions prior to 8.3.0 are susceptible to an authorization bypass vulnerability allowing authenticated users to read and overwrite arbitrary document data via the library/ajax/upload.php script.","title":"OpenEMR: Missing authorization in document upload (CVE-2026-124461)","url":"https://feed.craftedsignal.io/briefs/2026-11-openemr-auth-bypass-a575c508/"},{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:open-emr:openemr:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7.6,"id":"CVE-2026-124448"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["OpenEMR (\u003c 8.3.0)"],"_cs_severities":["high"],"_cs_tags":["xss","web-application-vulnerability","health-sector"],"_cs_type":"advisory","_cs_vendors":["OpenEMR"],"content_html":"\u003cp\u003eOpenEMR versions prior to 8.3.0 contain stored cross-site scripting (XSS) vulnerabilities within the CCDA/CCD preview stylesheets. Specifically, the cda.xsl and ccd.xsl files fail to properly sanitize input, allowing event-handler attributes such as onmouseover, onclick, and onfocus to be injected into previewed HTML. An authenticated attacker can upload a crafted CCDA/CCD document containing these malicious handlers to execute unauthorized JavaScript in the context of a clinician's session.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows authenticated attackers to execute arbitrary JavaScript within a clinician's session, potentially leading to unauthorized data access, session hijacking, or other actions performed with the clinician's privileges within the OpenEMR application.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade OpenEMR to version 8.3.0 or later to apply the fix for CVE-2026-124448.\u003c/li\u003e\n\u003cli\u003eImplement Content Security Policy (CSP) headers that restrict inline script execution to reduce the impact of XSS vulnerabilities.\u003c/li\u003e\n\u003cli\u003eAudit access logs for user accounts uploading CCDA/CCD documents to identify potential abuse of the file upload functionality.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-11-08T15:31:55Z","date_published":"2026-11-08T15:31:55Z","id":"https://feed.craftedsignal.io/briefs/2026-11-openemr-xss/","summary":"OpenEMR versions before 8.3.0 are vulnerable to stored cross-site scripting via maliciously crafted CCDA/CCD document attachments that execute scripts in a clinician's session upon preview.","title":"OpenEMR: Stored cross-site scripting in CCDA/CCD preview (CVE-2026-124448)","url":"https://feed.craftedsignal.io/briefs/2026-11-openemr-xss/"}],"language":"en","title":"CraftedSignal Threat Feed - Health-Sector","version":"https://jsonfeed.org/version/1.1"}