Vulnerability · Published Mar 11, 2026 · Assigned by GitHub_M
CVE-2026-32127SQL Injection Vulnerability in ajax graphs library (OpenEMR)
High 8.8
In plain English
A high-severity SQL injection in openemr from openemr. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 31% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code.
Official description
OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.0.0.1, OpenEMR contains a SQL injection vulnerability in the ajax graphs library that can be exploited by authenticated attackers. The vulnerability exists due to insufficient input validation in the ajax graphs library. This vulnerability is fixed in 8.0.0.1.
Affected products (as reported)
Weakness: CWE-89 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
References
- https://github.com/openemr/openemr/security/advisories/GHSA-v8q6-h79f-736x x_refsource_CONFIRM