CVE-2026-23627

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-23627

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-23627.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-23627

Aliases

GHSA-x3hw-rwrg-v25h

Published

2026-02-25T17:39:20.540Z

Modified

2026-03-01T07:33:13.270905Z

Severity

7.4 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P CVSS Calculator

Summary

OpenEMR has SQL Injection in Immunization Search/Report

Details

OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 8.0.0, an SQL injection vulnerability in the Immunization module allows any authenticated user to execute arbitrary SQL queries, leading to complete database compromise, PHI exfiltration, credential theft, and potential remote code execution. The vulnerability exists because user-supplied patient_id values are directly concatenated into SQL WHERE clauses without parameterization or escaping. Version 8.0.0 patches the issue.

Database specific

{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/23xxx/CVE-2026-23627.json",
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-89"
    ]
}

References

Affected packages

Git / github.com/openemr/openemr

Affected ranges

Type: GIT
Repo: https://github.com/openemr/openemr
Events: Introduced

0 Unknown introduced commit / All previous commits are affected

Fixed

b91b73600327acb46252b9fce7d04467eea126fd

Affected versions

Other

v2_7_2

v2_7_2-rc1

v2_7_2-rc2

v2_7_3-rc1

v2_8_0

v2_8_1

v2_8_2

v2_8_3

v2_9_0

v3_0_0

v3_0_1

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-23627.json"