OpenEMR Flaws Expose Patient Search to SQL Injection and Eye Exam Forms to Stored XSS
Sector Threat Intelligence · 2 sources · Updated 4mo ago · First seen Mar 26, 2026
OpenEMR disclosed two high-severity vulnerabilities affecting versions prior to 8.0.0.3, including an authenticated blind boolean-based SQL injection tracked as CVE-2026-29187 and a stored cross-site scripting flaw tracked as CVE-2026-33348. The SQL injection issue resides in the Patient Search component at /interface/new/new_search_popup.php and can be triggered by manipulating HTTP parameter keys rather than values, allowing a low-privileged authenticated attacker to target sensitive data and application integrity without user interaction.
The second flaw affects the Eye Exam form workflow, where a user with the Notes - my encounters role can inject malicious JavaScript into form answers such as $CHRONIC2 and $CHRONIC3. That payload is later executed when users with the same role view the encounter page or visit history, creating a stored XSS path inside the clinical workflow. Both issues were assigned on March 25, 2026, mapped to CWE-89 and CWE-79 respectively, and were patched in OpenEMR 8.0.0.3, with fixes published through the project release, commit history, and security advisory.
