Blind SQL Injection in OpenEMR's PostCalendar Module

CVE-2026-33914

What is CVE-2026-33914?

The PostCalendar module in OpenEMR, an open-source electronic health records and management system, has a critical flaw causing blind SQL injection through the categoriesUpdate administrative function. Prior to the release of version 8.0.0.3, the dels POST parameter was processed unsafely, as it was only stripped of HTML tags without any SQL escaping. This oversight allowed attackers to interpolate arbitrary values into a raw SQL DELETE statement, jeopardizing the security of the application. Version 8.0.0.3 addresses this vulnerability, ensuring safer handling of user inputs.

References