CVE-2026-124444: OpenEMR before 8.4.0 SQL Injection via OnsiteDocument Query API
Published Nov 8, 2026
·Updated
OpenEMR before 8.4.0 contains a mass assignment vulnerability in the patient portal OnsiteDocument query API that lets request parameters set bitwise criteria filters whose values are placed unquoted into the SQL WHERE clause. Authenticated patient portal users can inject SQL via parameters such as IdBitwiseAnd to read any database table, including other patients' records and staff password hashes.
Event History
Nov 8, 2026
CVE Published
via MITRE·01:15 PM
Data Sourced
via MITRE·01:15 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·02:18 PM
DescriptionSeverityWeakness