CVE-2026-23627 - Vulnerability Analysis

Overview

OpenEMR < 8.0.0 contains an SQL injection caused by unsanitized patient_id input concatenated into SQL WHERE clauses in the Immunization module, letting authenticated users execute arbitrary SQL queries and compromise the database.

Severity & Score

Impact

Authenticated users can execute arbitrary SQL queries, leading to full database compromise, PHI exfiltration, credential theft, and potential remote code execution.

Mitigation

Upgrade to version 8.0.0 or later.

References

• https://github.com/openemr/openemr/commit/cbf4ea4345b14a6c8362201e30c74ffb0949cdb1
• https://github.com/openemr/openemr/security/advisories/GHSA-x3hw-rwrg-v25h

Social Media Activity(1 post)

TheHackerWire

@thehackerwire

Mar 1, 2026

🟠 CVE-2026-23627 - High (8.8) OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 8.0.0, an SQL injection vulnerability in the Immunization module allows any authenticated user to execute arbitrary SQL queri... 🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-23627/ #CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

View original post

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner