CVE-2026-126488
HIGH
NVD
CVSS Score
7.7
Severity
HIGH
Published
Nov 13, 2026
Vendor
unknown
Description
OpenEMR before 8.5.0 contains an SQL injection vulnerability in the patient portal OnsiteDocument.Query endpoint, where mass-assigned _BitwiseAnd criteria parameters are placed unquoted into SQL with only quote-character escaping. Authenticated portal patients can inject SQL outside their per-patient scope to read the entire database, including other patients' demographics and users_secure password hashes.