{"id":"CVE-2026-29187","aliases":["EUVD-2026-16008","GHSA-2r7h-xm8v-m872"],"status":"published","title":"OpenEMR Vulnerable to Authenticated Blind Boolean-Based SQL Injection in new_search_popup.php","description":"OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 8.0.0.3, a Blind SQL Injection vulnerability exists in the Patient Search functionality (/interface/new/new_search_popup.php). The vulnerability allows an authenticated attacker to execute arbitrary SQL commands by manipulating the HTTP parameter keys rather than the values. Version 8.0.0.3 contains a patch.","severity":{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00492,"percentile":0.42722,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":false},"cwes":["CWE-89"],"published":"2026-03-25T22:24:24Z","modified":"2026-10-28T02:30:23Z","exploits":[{"source":"pocgithub","id":"ChrisSub08/CVE-2026-29187_SqlInjectionVulnerabilityOpenEMR7.0.4","title":"ChrisSub08/CVE-2026-29187_SqlInjectionVulnerabilityOpenEMR7.0.4","date":"2026-02-10","url":"https://github.com/ChrisSub08/CVE-2026-29187_SqlInjectionVulnerabilityOpenEMR7.0.4"}],"products":[{"vendor":"open-emr","product":"openemr"},{"vendor":"openemr","product":"openemr"}],"references":[{"url":"https://github.com/openemr/openemr/security/advisories/GHSA-2r7h-xm8v-m872","tags":["x_refsource_CONFIRM","Exploit","Vendor Advisory","advisory"]},{"url":"https://github.com/openemr/openemr/commit/c61887aa7c83e83b3282db05246f1c00de3aa21d","tags":["x_refsource_MISC","Patch","fix"]},{"url":"https://github.com/openemr/openemr/releases/tag/v8_0_0_3","tags":["x_refsource_MISC","Product","web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/29xxx/CVE-2026-29187.json","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-29187","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-29187","title":"OpenEMR Vulnerable to Authenticated Blind Boolean-Based SQL Injection in new_search_popup.php","description":"OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 8.0.0.3, a Blind SQL Injection vulnerability exists in the Patient Search functionality (/interface/new/new_search_popup.php). The vulnerability allows an authenticated attacker to execute arbitrary SQL commands by manipulating the HTTP parameter keys rather than the values. Version 8.0.0.3 contains a patch.","status":"published","published":"2026-03-25T22:24:24.204Z","modified":"2026-03-26T19:52:12.052Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","level":"high","assessor":"cna"}],"cwes":["CWE-89"],"updated_at":"2026-11-02T14:19:56.284359Z"}],"euvd":[{"id":"EUVD-2026-16008","description":"OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 8.0.0.3, a Blind SQL Injection vulnerability exists in the Patient Search functionality (/interface/new/new_search_popup.php). The vulnerability allows an authenticated attacker to execute arbitrary SQL commands by manipulating the HTTP parameter keys rather than the values. Version 8.0.0.3 contains a patch.","status":"published","published":"2026-03-25T22:24:24Z","modified":"2026-03-26T19:52:12Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T19:25:27.67679Z"}],"nvd":[{"id":"CVE-2026-29187","description":"OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 8.0.0.3, a Blind SQL Injection vulnerability exists in the Patient Search functionality (/interface/new/new_search_popup.php). The vulnerability allows an authenticated attacker to execute arbitrary SQL commands by manipulating the HTTP parameter keys rather than the values. Version 8.0.0.3 contains a patch.","status":"published","published":"2026-03-25T23:17:09.34Z","modified":"2026-06-17T10:29:44.657Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","level":"high","assessor":"secondary"},{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"}],"cwes":["CWE-89"],"updated_at":"2026-11-02T14:12:11.077116Z"}],"osv":[{"id":"CVE-2026-29187","title":"OpenEMR Vulnerable to Authenticated Blind Boolean-Based SQL Injection in new_search_popup.php","description":"OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 8.0.0.3, a Blind SQL Injection vulnerability exists in the Patient Search functionality (/interface/new/new_search_popup.php). The vulnerability allows an authenticated attacker to execute arbitrary SQL commands by manipulating the HTTP parameter keys rather than the values. Version 8.0.0.3 contains a patch.","status":"published","published":"2026-03-25T22:24:24.204Z","modified":"2026-10-28T02:30:23.756732278Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"cwes":["CWE-89"],"updated_at":"2026-11-02T15:45:00.530889Z"}]}}