CVE-2026-33917: OpenEMR has SQL Injection in CAMOS Form
OpenEMR is a free and open source electronic health records and medical practice management application. Versions prior to 8.0.0.3 contais a SQL injection vulnerability in the ajaxsave CAMOS form that can be exploited by authenticated attackers. The vulnerability exists due to insufficient input validation in the ajaxsave page in the CAMOS form. Version 8.0.0.3 patches the issue.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2026-33917?
CVE-2026-33917 is considered a high severity vulnerability due to its SQL injection capabilities that can be exploited by authenticated attackers.
How do I fix CVE-2026-33917?
To fix CVE-2026-33917, upgrade OpenEMR to version 8.0.0.3 or later.
Who is affected by CVE-2026-33917?
CVE-2026-33917 affects users of OpenEMR versions prior to 8.0.0.3.
What type of vulnerability is CVE-2026-33917?
CVE-2026-33917 is an SQL injection vulnerability affecting the CAMOS form in OpenEMR.
Can CVE-2026-33917 be exploited remotely?
No, CVE-2026-33917 requires authentication, meaning only authenticated users can exploit this SQL injection vulnerability.