CVE-2026-33914 PUBLISHED

OpenEMR has SQL Injection in PostCalendar Category Delete

Assigner: GitHub_M
Reserved: 24.03.2026 Published: 25.03.2026 Updated: 25.03.2026

OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 8.0.0.3, the PostCalendar module contains a blind SQL injection vulnerability in the categoriesUpdate administrative function. The dels POST parameter is read via pnVarCleanFromInput(), which only strips HTML tags and performs no SQL escaping. The value is then interpolated directly into a raw SQL DELETE statement that is executed unsanitized via Doctrine DBAL's executeStatement(). Version 8.0.0.3 patches the issue.

Metrics

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CVSS Score: 7.2

Product Status

Vendor openemr
Product openemr
Versions
  • Version < 8.0.0.3 is affected

References

Problem Types

  • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') CWE