Back Nvd.Nist

CVE-2026-33912 Detail

Nvd.Nist • March 26, 2026

OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 8.0.0.3, an authenticated attacker could craft a malicious form that, when submitted by a victim, executes arbitrary JavaScript in the victim's browser session. Version 8.0.0.3 patches the issue.

Denotes Vulnerable Software Are we missing a CPE here? Please let us know .

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

High-Severity SQL Injection Vulnerability in OpenEMR (CVE-2026-33917) A critical SQL injection vulnerability (CVE-2026-33917) has been identified in OpenEMR versions prior to 8.0.0.3, affecting the ajax_save CAMOS form. This vulnerability arises from insufficient input validation, allowing authenticated attackers to execute arbitrary database commands. The potential impact includes unauthorized access, modification, or deletion of sensitive patient records and electronic health records (EHR) data. The CVSS v3.1 base score for this vulnerability is 8.8, indicating high severity with significant implications for confidentiality, integrity, and availability. Multiple proof-of-concept exploits have been released, increasing the urgency for organizations to patch their systems. A security patch was made available on March 26, 2026, and users are advised to upgrade to version 8.0.0.3 or later. There is currently no evidence of exploitation in the wild, but the risk remains high due to the nature of the vulnerability. Organizations should prioritize patching and consider implementing additional access controls until updates are completed. 2 sources 72

Extracted Entities

CVE-2026-33912 Detail

The full story

Extracted Entities

CVEs (1)

MITRE ATT&CK (1)

Platforms (1)

Vulnerabilities (1)