CVE-2026-126425
HIGH
NVD
CVSS Score
7.2
Severity
HIGH
Published
Nov 13, 2026
Vendor
unknown
Description
OpenEMR before 8.5.0 contains a stored SQL injection vulnerability in which History layout field identifiers saved through edit_layout.php, including HIS fields and LBF source-H fields, are placed unvalidated into an INSERT statement for patients without a history_data row. Users with admin/super and patients/med write access can trigger history_save.php or LBF saves to execute SQL functions like SLEEP, tying up database workers or accessing data beyond their privileges.