PT-2026-21970 · Openemr · Openemr

Pavelkohout396 + 1 · Publicado 2026-02-25 · Atualizado 2026-02-27 · CVE-2026-23627

Positive Technologies (AI Summary)

CVSS v3.1

8.8

Alta

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions OpenEMR versions prior to 8.0.0

Description OpenEMR is an electronic health records and medical practice management application. A flaw exists in the Immunization module where user-supplied patient id values are directly incorporated into SQL queries without proper sanitization. This allows any authenticated user to execute arbitrary SQL queries, potentially leading to database compromise, unauthorized access to protected health information (PHI), credential theft, and remote code execution.

Recommendations Update to version 8.0.0 or later.

Exploit

Correção

RCE

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

CVE-2026-23627

GHSA-X3HW-RWRG-V25H

Produtos afetados

Openemr

Referências · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/23xxx/CVE-2026-23627.json · Exploit
• https://github.com/openemr/openemr/commit/cbf4ea4345b14a6c8362201e30c74ffb0949cdb1 · Correção
• https://github.com/openemr/openemr/security/advisories/GHSA-x3hw-rwrg-v25h · Aviso do Fabricante
• https://twitter.com/TheHackerWire/status/2027458913524978093 · Publicação no Twitter
• https://t.me/cveNotify/153497 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2026-23627 · Aviso do Fabricante
• https://twitter.com/CVEnew/status/2027099309733478526 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2026-23627 · Nota de Segurança