What is the CVSS score of CVE-2026-25746?

CVE-2026-25746 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Openemr are affected by CVE-2026-25746?

OpenEMR installations running versions before 8.0.0 contain a SQL injection vulnerability in the prescription module that authenticated users can exploit to access or manipulate sensitive patient…. A patch is available.

Is there a public PoC exploit available for CVE-2026-25746?

Yes, a public proof-of-concept exploit is available for CVE-2026-25746. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-25746?

Within 24 hours: Inventory all OpenEMR deployments and identify versions prior to 8.0.0; notify clinical and IT leadership of exposure scope. Within 7 days: Apply OpenEMR 8.0.0 or later patch to all affected instances; prioritize production systems first. Within 30 days: Complete patching across all environments; conduct post-patch validation and review access logs for signs of exploitation.

Openemr CVE-2026-25746

HIGH

SQL Injection (CWE-89)

2026-02-25 security-advisories@github.com

SQLi Openemr

8.8

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 21:55 vuln.today

PoC Detected

Feb 27, 2026 - 14:40 vuln.today

Public exploit code

Patch released

Feb 27, 2026 - 14:40 nvd

Patch available

CVE Published

Feb 25, 2026 - 19:43 nvd

HIGH 8.8

DescriptionGitHub Advisory

OpenEMR is a free and open source electronic health records and medical practice management application. Versions prior to 8.0.0 contain a SQL injection vulnerability in prescription that can be exploited by authenticated attackers. The vulnerability exists due to insufficient input validation in the prescription listing functionality. Version 8.0.0 fixes the vulnerability.

AnalysisAI

SQL injection in OpenEMR versions before 8.0.0 allows authenticated users to execute arbitrary database queries through the prescription listing feature due to improper input validation. An attacker with valid credentials could exploit this to read, modify, or delete sensitive medical records and patient data. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

Authenticate as OpenEMR user

Delivery

Access prescription listing interface

Exploit

Inject SQL payload in prescription parameter

Execution

Execute arbitrary SQL queries

Impact

Extract sensitive data or modify database

Access

Authenticate as OpenEMR user

Delivery

Access prescription listing interface

Exploit

Inject SQL payload in prescription parameter

Execution

Execute arbitrary SQL queries

Impact

Extract sensitive data or modify database

Vulnerability AssessmentAI

Exploitation	Authenticated user account required on OpenEMR versions prior to 8.0.0. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	CVSS 8.8 (HIGH). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	An attacker (requires authentication) could exploit this vulnerability to compromise the affected system.
Remediation	A vendor patch is available — apply it immediately. … Detailed patch versions, workarounds, and compensating controls in full report.

Recommended ActionAI

Within 24 hours: Inventory all OpenEMR deployments and identify versions prior to 8.0.0; notify clinical and IT leadership of exposure scope. …

Threat intelligence, references, and detailed analysis are available after sign-in.

CVE-2026-25746 vulnerability details – vuln.today

Back

Openemr CVE-2026-25746

Severity by source

CVSS VectorGitHub Advisory

Lifecycle Timeline

DescriptionGitHub Advisory

AnalysisAI

Unlock full vulnerability intelligence

Attack ChainAIDerived

Vulnerability AssessmentAI

Recommended ActionAI

Share

External POC / Exploit Code