PT-2026-28144 · Openemr · Openemr

Published 2026-03-25 · Updated 2026-03-26 · CVE-2026-33914

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions OpenEMR versions prior to 8.0.0.3

Description OpenEMR is an electronic health records and medical practice management application. Versions prior to 8.0.0.3 contain a blind SQL injection issue within the PostCalendar module. The dels POST parameter is processed by the pnVarCleanFromInput() function, which removes HTML tags but does not perform SQL escaping. This unsanitized value is then directly incorporated into a raw SQL DELETE statement and executed using Doctrine DBAL's executeStatement() function. The vulnerable function is categoriesUpdate.

Recommendations Update to version 8.0.0.3 or later.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2026-33914

GHSA-RQ3V-38X5-3RM5

Affected Products

Openemr

References · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33914.json · Exploit
• https://github.com/openemr/openemr/security/advisories/GHSA-rq3v-38x5-3rm5 · Vendor Advisory
• https://github.com/openemr/openemr/commit/1b851fc9af84f181ad7a84210a168d0d568cd442 · Patch
• https://osv.dev/vulnerability/CVE-2026-33914 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-33914 · Security Note
• https://github.com/openemr/openemr/releases/tag/v8_0_0_3 · Note
• https://twitter.com/CVEnew/status/2037137786818470189 · Twitter Post