Loading story…
A critical remote code execution flaw, tracked as CVE-2026-39932, affects OpenEMR through version 8.2.0 and stems from an unsafe eval() call in the document category tree component, specifically library/classes/Tree.class.php. The bug allows attacker-controlled PHP code stored in the categories database table to be executed when the application instantiates CategoryTree, turning a database-level compromise into code execution on the server. The issue has been rated 9.4 (CVSS 4.0) and 9.1 (CVSS 3.1).
Public reporting says an authenticated administrator can chain arbitrary SQL execution to alter the id column type to VARCHAR and insert a malicious PHP payload, which is then triggered by both authenticated and unauthenticated page activity that loads the category tree. Successful exploitation can lead to operating system command execution as the web server user. Defenders are advised to upgrade to OpenEMR 8.2.1 or later and review database integrity, input sanitization, administrative access, and signs of unauthorized command execution.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
2 events from the most recent confirmed update back to the earliest known activity.
A critical remote code execution vulnerability affecting OpenEMR through version 8.2.0 was published as CVE-2026-39932. The flaw is in the document category tree component, where an unsanitized eval() call in Tree.class.php can execute attacker-controlled PHP code stored in the categories table.
The vulnerability advisory recommends updating OpenEMR to version 8.2.1 or later to address CVE-2026-39932. Additional remediation guidance includes reviewing database integrity, sanitizing inputs, restricting administrative privileges, and monitoring for unauthorized command execution.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
3 references tracked. Mallory keeps watching after this page renders.
cvefeed.io
Open sourcevulncheck.com
Open sourcejivasecurity.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
OpenEMR disclosed two high-severity vulnerabilities affecting versions prior to **8.0.0.3**, including an authenticated blind boolean-based SQL injection tracked as `CVE-2026-29187` and a stored cross-site scripting flaw tracked as `CVE-2026-33348`. The SQL injection issue resides in the Patient Search component at `/interface/new/new_search_popup.php` and can be triggered by manipulating HTTP parameter keys rather than values, allowing a low-privileged authenticated attacker to target sensitive data and application integrity without user interaction. The second flaw affects the Eye Exam form workflow, where a user with the **`Notes - my encounters`** role can inject malicious JavaScript into form answers such as `$CHRONIC2` and `$CHRONIC3`. That payload is later executed when users with the same role view the encounter page or visit history, creating a stored XSS path inside the clinical workflow. Both issues were assigned on March 25, 2026, mapped to **CWE-89** and **CWE-79** respectively, and were patched in **OpenEMR 8.0.0.3**, with fixes published through the project release, commit history, and security advisory.
Jun 29, 2026
A high-severity vulnerability tracked as **CVE-2026-23697** affects **Vtiger CRM** versions up to **8.3.0**, allowing a low-privileged authenticated user to achieve remote code execution through the **Documents** module. The flaw stems from an incomplete extension denylist in `config.inc.php` that does not block `.phar` files, enabling an attacker to upload a malicious archive containing arbitrary PHP code. The issue is classified as **CWE-434** and carries a **CVSS v3.1** score vector of `AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H`.
Jul 7, 2026
A critical blind SQL injection flaw tracked as **`CVE-2026-57517`** affects **Control Web Panel** versions **`<= 0.9.8.1224`** through the **`userRes`** POST parameter on the user endpoint. Public disclosure says the bug can be exploited remotely without authentication, although an attacker may need to know or guess a valid non-root username on the target instance. The issue carries a **CVSS v3.1 score of 9.8** and allows arbitrary SQL execution against the backend database with **MySQL root** privileges. The disclosed attack path shows the database access can be escalated into arbitrary file write using MySQL features such as **`INTO DUMPFILE`**, allowing a PHP webshell to be written into a web-accessible **Roundcube logs** directory and resulting in remote code execution as the **`cwpsvc`** account. The vulnerability was disclosed by **Egidio Romano**, and the vendor has fixed it in **Control Web Panel `0.9.8.1225`**; administrators are being urged to upgrade immediately and apply the vendor's security updates.
Jul 2, 2026