Vulnerability intelligence
CVE-2026-23627
OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 8.0.0, an SQL injection vulnerability in the Immunization module allows any authenticated user to execute arbitrary SQL queries, leading to complete database compromise, PHI exfiltration, credential theft, and potential remote code execution. The vulnerability exists because user-supplied `patient_id` values are directly concatenated into SQL WHERE clauses without parameterization or escaping. Version 8.0.0 patches the issue.
CVSS Score
7.4
High
EPSS — Exploit Probability
0.8%
Riskier than 52% of all CVEs
Exploitation
Not in CISA KEV
No federal exploitation record
Remediation
Patch available
Vendor fix published
3 articles across 3 outlets · first covered Apr 29, 2026 · latest Apr 30, 2026
Coverage timeline
-
SMS blaster bust, OpenEMR flaws, 600K Roblox accounts hackedthehackernews.com · Apr 30, 2026
-
AI audit finds 38 OpenEMR flaws, CVE-2026-24908 leaks PHIwww.darkreading.com · Apr 29, 2026
-
OpenEMR bugs risk patient data leak and remote code executionwww.securityweek.com · Apr 29, 2026