CVE-2026-33910highCWE-89

CVE-2026-33910: fallo de gravedad alta en openemr

OpenEMR has a SQL Injection Vulnerability in patient selection

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear openemr

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

21Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 7.2epss 0.4%
OpenEMR is a free and open source electronic health records and medical practice management application. Versions up to and including 8.0.0.2 contain a SQL injection vulnerability in the patient selection feature that can be exploited by authenticated attackers. The vulnerability exists due to insufficient input validation in the patient selection feature. Version 8.0.0.3 contains a patch.
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Productos afectados
openemr · openemr
CVEs relacionadas — openemr

En el mismo producto, de las más peligrosas a las menos.

CVE-2025-31121HIGHOpenEMR allows XSS in Patient Image featureEPSS 17.3%CVE-2025-43860HIGHOpemEMR Vulnerable to Stored XSS Attack in the Additional Address Section of Patient DemographicsEPSS 15.0%CVE-2025-30161HIGHOpenEMR Stored XSS in OpenEMR Bronchitis FormEPSS 10.9%CVE-2025-32794HIGHOpenEMR Stored XSS via Patient Name Field in Procedure OrdersEPSS 10.5%CVE-2026-24848HIGHOpenEMR Arbitrary File Write leading to Remote Code ExecutionEPSS 7.2%CVE-2025-69231HIGHOpenEMR has a Stored XSS in GAD-7 Form that Enables Session Hijacking and Privilege EscalationEPSS 4.1%