CVE-2026-29187 — OpenEMR Vulnerable to Authenticated Blind Boolean-Based SQL Injection in new_search_popup.php
OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 8.0.0.3, a Blind SQL Injection vulnerability exists in …
Published: 2026-03-25 · CVSS: 8.1 · CVSS 3.1
OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 8.0.0.3, a Blind SQL Injection vulnerability exists in the Patient Search functionality (/interface/new/new_search_popup.php). The vulnerability allows an authenticated attacker to execute arbitrary SQL commands by manipulating the HTTP parameter keys rather than the values. Version 8.0.0.3 contains a patch.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7