CVE-2026-33910: OpenEMR has a SQL Injection Vulnerability in patient selection

Q: What is the severity of CVE-2026-33910?

CVE-2026-33910 has been classified as a medium severity SQL injection vulnerability.

Q: How do I fix CVE-2026-33910?

To fix CVE-2026-33910, upgrade OpenEMR to version 8.0.0.3 or later.

Q: What versions are affected by CVE-2026-33910?

CVE-2026-33910 affects OpenEMR versions up to and including 8.0.0.2.

Q: What can an attacker do with CVE-2026-33910?

An attacker can exploit CVE-2026-33910 to perform SQL injection attacks, potentially accessing sensitive patient information.

Q: Is there a patch available for CVE-2026-33910?

Yes, a patch is available with the release of OpenEMR version 8.0.0.3.

Published Mar 25, 2026

Updated

OpenEMR is a free and open source electronic health records and medical practice management application. Versions up to and including 8.0.0.2 contain a SQL injection vulnerability in the patient selection feature that can be exploited by authenticated attackers. The vulnerability exists due to insufficient input validation in the patient selection feature. Version 8.0.0.3 contains a patch.

Affected Software

2 affected components

OpenEMR OpenEMR<=8.0.0.2

open-emr Openemr<8.0.0.3

Remediation

Patch Available

https://github.com/openemr/openemr/commit/73db3264aed253684532839380cae3b0a56c83d2

Event History

Mar 25, 2026

CVE Published

via MITRE·10:41 PM

Data Sourced

via MITRE·10:41 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·11:17 PM

RemedyDescriptionSeverityWeaknessAffected Software

Jun 19, 58205

Event

via FIRST·01:16 AM

Frequently Asked Questions

What is the severity of CVE-2026-33910?

CVE-2026-33910 has been classified as a medium severity SQL injection vulnerability.

How do I fix CVE-2026-33910?

To fix CVE-2026-33910, upgrade OpenEMR to version 8.0.0.3 or later.

What versions are affected by CVE-2026-33910?