www.vulncheck.com OpenEMR and Craft CMS Vulnerabilities Expose SQL Injection Risks
Article Content
Browse articles 
- •OpenEMR and Craft CMS have critical SQL injection vulnerabilities.
- •Both vulnerabilities allow unauthorized SQL command execution via specific APIs.
- •Patches are available; users should update to prevent potential exploitation.
Two SQL injection vulnerabilities have been identified in OpenEMR versions before 8.4.0 and Craft CMS versions before 4.18.9. Both vulnerabilities, classified under CWE-89, allow attackers to manipulate SQL queries through specific API endpoints. OpenEMR's vulnerability is associated with the onsitedocument query API, while Craft CMS's issue involves the getnext and getprev criteria. These vulnerabilities could potentially lead to unauthorized data access or manipulation. Patches have been released for both systems, and users are urged to update immediately to mitigate risks. The vulnerabilities have not been reported as in the wild as of the latest updates.
Ask AI about this cluster
Answers cite the sources they use
Updated 7h ago How this analysis works
Timeline
2026-11-06
Craft CMS vulnerability disclosed
Craft CMS versions before 4.18.9 were found vulnerable to SQL injection via getnext and getprev criteria.
VulnCheck2026-11-09
OpenEMR vulnerability disclosed
OpenEMR versions before 8.4.0 are vulnerable to SQL injection via onsitedocument query API.
VulnCheckMore articles in this cluster (2)
Common questions
Which versions of OpenEMR are affected?
OpenEMR versions before 8.4.0 are affected by the SQL injection vulnerability.
What should I do to protect my systems?
Update to the latest versions of OpenEMR and Craft CMS to mitigate the SQL injection risks.
Are these vulnerabilities being exploited in the wild?
As of now, there are no reports of active exploitation for these vulnerabilities.
Continue Reading
Volt Typhoon's Silent Train Network Targets US Critical Infrastructure The Chinese state-sponsored hacking group Volt Typhoon has been linked to a covert network called Silent Train, which has exploited at least four zero-day vulnerabilities over three years. This network utilizes rapidly rotating chains of compromised SOHO routers, IoT devices, and enterprise infrastructure to access… 
GitLab Issues Emergency Patch for Critical RCE Vulnerability GitLab has released emergency patches for a critical remote code execution vulnerability, CVE-2026-97229, affecting its Community and Enterprise Editions. This flaw, stemming from an integer overflow in the CI/CD regular expression compiler, allows unauthenticated attackers to execute arbitrary code via specially…