Blind SQL Injection in OpenEMR's PostCalendar Module
CVE-2026-33914
What is CVE-2026-33914?
The PostCalendar module in OpenEMR, an open-source electronic health records and management system, has a critical flaw causing blind SQL injection through the categoriesUpdate administrative function. Prior to the release of version 8.0.0.3, the dels POST parameter was processed unsafely, as it was only stripped of HTML tags without any SQL escaping. This oversight allowed attackers to interpolate arbitrary values into a raw SQL DELETE statement, jeopardizing the security of the application. Version 8.0.0.3 addresses this vulnerability, ensuring safer handling of user inputs.
Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.
Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.
Affected Version(s)
openemr < 8.0.0.3