Skip to content
OpenAdvisories
High · 8.1 Public exploit CVE-2026-29187 EUVD-2026-16008

OpenEMR Vulnerable to Authenticated Blind Boolean-Based SQL Injection in new_search_popup.php

Published Mar 25, 2026 · Updated Mar 26, 2026 · Assigned by GitHub_M

Vendor: Open-Emr Product: openemr

Description

OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 8.0.0.3, a Blind SQL Injection vulnerability exists in the Patient Search functionality (/interface/new/new_search_popup.php). The vulnerability allows an authenticated attacker to execute arbitrary SQL commands by manipulating the HTTP parameter keys rather than the values. Version 8.0.0.3 contains a patch.

Affected products

VendorProductAffectedFixed
openemr openemr < 8.0.0.3 —

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

GitHub 1 repository

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

References