CVE-2026-25746: OpenEMR has SQL Injection Vulnerability
OpenEMR is a free and open source electronic health records and medical practice management application. Versions prior to 8.0.0 contain a SQL injection vulnerability in prescription that can be exploited by authenticated attackers. The vulnerability exists due to insufficient input validation in the prescription listing functionality. Version 8.0.0 fixes the vulnerability.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
OpenEMRto a version that resolves this vulnerability.Fixed in 8.0.0
Event History
Frequently Asked Questions
What is the severity of CVE-2026-25746?
CVE-2026-25746 is considered a high severity SQL injection vulnerability affecting OpenEMR versions prior to 8.0.0.
How do I fix CVE-2026-25746?
To fix CVE-2026-25746, upgrade OpenEMR to version 8.0.0 or later, which addresses the SQL injection vulnerability.
Who is affected by CVE-2026-25746?
Authenticated attackers using OpenEMR versions prior to 8.0.0 can exploit CVE-2026-25746 due to inadequate input validation.
What could an attacker achieve by exploiting CVE-2026-25746?
Exploiting CVE-2026-25746 could allow an attacker to execute arbitrary SQL queries on the database, potentially compromising confidential patient data.
Is there a workaround for CVE-2026-25746?
There are no specific workarounds for CVE-2026-25746; the best course of action is to update to the patched version 8.0.0 or higher.