HIGHCVSS 7.10% EPSS
OpenEMR before 8.5.0 contains a second-order sql injection vulnerability that allows low-privileged authenticated users to store malicious SQL via library/ajax/addlistitem.php. Attackers can persist a SQL fragment in the recent_patient_columns option_id value, which dynamic_finder.php concatenates into a SELECT query and executes as SQL.
Published 2026-11-13 · last modified 2026-11-13
| Vendor | Product |
|---|---|
| open-emr | openemr |
Ncerio by BeyondNets · data from NVD, CISA KEV, EPSS.