OpenEMR

OpenEMR versions prior to 8.5.0 contain an authenticated SQL injection vulnerability in the Syndromic Surveillance module, enabling Clinician-level users to perform error-based data exfiltration and administrative account takeover.

OpenEMR versions 8.2.0 and earlier are vulnerable to authenticated remote code execution via SQL injection and unsafe eval() calls in the document category tree component.

A public exploit (EDB-52610) has been published for OpenEMR versions prior to 7.0.4, detailing an authenticated arbitrary file read vulnerability (CVE-2026-24849) in the Fax/SMS module's `EtherFaxActions::disposeDoc()` method, which allows a low-privileged authenticated user to read and potentially delete any file accessible by the web server user due to a lack of path validation on the `file_path` request parameter.

OpenEMR versions up to 8.0.0.2 are vulnerable to SQL injection in the patient selection feature, which can be exploited by authenticated attackers due to insufficient input validation, potentially leading to unauthorized data access and modification.

A stored cross-site scripting (XSS) vulnerability in OpenEMR's CCDA document preview (CVE-2026-33932) allows an attacker to execute arbitrary JavaScript in a clinician's browser session by uploading a malicious CCDA document.

A blind SQL injection vulnerability exists in the PostCalendar module of OpenEMR versions prior to 8.0.0.3 due to improper sanitization of the `dels` POST parameter, potentially allowing attackers to execute arbitrary SQL commands.

OpenEMR version 7.0.1 is vulnerable to an authentication brute force attack where attackers can bypass rate limiting by sending repeated login attempts, leading to potential unauthorized access.