Blind SQL Injection in OpenEMR's Patient Search Functionality

CVE-2026-29187

What is CVE-2026-29187?

A Blind SQL Injection vulnerability has been identified in OpenEMR's Patient Search functionality, specifically in the new_search_popup.php interface. This security issue allows authenticated attackers to craft malicious SQL commands through manipulation of HTTP parameter keys, compromising the integrity of the database. The vulnerability is present in versions prior to 8.0.0.3, which has since been patched. It's crucial for users to update their OpenEMR installations to mitigate risks associated with unauthorized data access and manipulation.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References