CVE-2026-126465

EUVD-2026-124959
OpenEMR before 8.5.0 contains an SQL injection vulnerability in the patient portal api/onsiteactivityviews endpoint that allows any authenticated staff user to inject SQL through unquoted Id_BitwiseAnd Criteria values. Attackers can close the bitwise parenthesis and append OR or UNION SELECT clauses to read patient PHI, staff password hashes, MySQL authentication strings, and API tokens.
SQL Injection
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
6.5 MEDIUM
NETWORK
LOW
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Awaiting analysis
This vulnerability is currently awaiting analysis.
Base Score
CVSS 3.x
EPSS Score
Percentile: 38.64%
Common Weakness Enumeration
References
https://github.com/openemr/openemr/security/advisories/GHSA-vvj8-xpx8-p293
https://www.vulncheck.com/advisories/openemr-before-8.5.0-sql-injection-via-onsiteactivityview-bitwiseand-criteria
https://github.com/openemr/openemr/security/advisories/GHSA-vvj8-xpx8-p293