CVE-2026-49142

    Dashboard / Vulnerabilities / CVE-2026-49142

    CVE-2026-49142

    Published: 29 Oct 2026Last Modified: 5 Nov 2026

    Summary: OpenEMR Before 8.5.0 SQL Injection via form_icd_codes[]

    Details: OpenEMR before 8.5.0 contains an authenticated SQL injection vulnerability in the Syndromic Surveillance module that allows users with Clinician-level privileges to read and modify arbitrary database contents by submitting crafted values in the form_icd_codes[] POST parameter to the syndromicsurveillance/index endpoint. Attackers can inject an unquoted numeric IN() clause and UNION DISTINCT SELECT statement using hex-encoded literals to abuse MySQL extractvalue() for error-based exfiltration of bcrypt password hashes and execute stacked queries that reset passwords, resulting in full administrative account takeover.

    References: https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/49xxx/CVE-2026-49142.json, https://github.com/openemr/openemr/releases/tag/v8_5_0, https://github.com/openemr/openemr/security/advisories/GHSA-w99c-jwcm-24hh, https://nvd.nist.gov/vuln/detail/CVE-2026-49142, https://www.vulncheck.com/advisories/openemr-before-sql-injection-via-form-icd-codes, https://github.com/openemr/openemr/commit/9b52cc0fc3a4eddd9fa7a096f6a3ac2a57d772d0, https://github.com/openemr/openemr/pull/14329, https://github.com/openemr/openemr

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 0
    Fixed -c1b2b8bcbe91aa81858f7ba8b25c31d9a82639a5

    Affected versions

    v3_0_1

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2026-49142 | CVE-DB