CVE-2018-15146

HIGH 8.8CVE-2018-15146 · Published 15/08/2018 · updated 17/06/2026

In short

CVE-2018-15146 is a HIGH (CVSS 8.8) vulnerability affecting openemr (open-emr).
Chance of exploitation in the next 30 days (EPSS): 2.4%, higher than 83.9% of all vulnerabilities.
No patched version is listed yet: follow the vendor's advisory in References.

Package	Affected versions	Patched versions
openemr open-emr	`≤ 5.0.1.3`	No fix yet

Description

SQL injection vulnerability in interface/de_identification_forms/find_immunization_popup.php in versions of OpenEMR before 5.0.1.4 allows a remote authenticated attacker to execute arbitrary SQL commands via the 'search_term' parameter.

References

openemr/openemr#1757 · Third Party Advisory
insecurity.sh/reports/openemr.pdf · Exploit
databreaches.net/openemr-patches-serious-vulnerabilities-uncovered-by-project-insecurity · Third Party Advisory
open-emr.org/wiki/index.php/OpenEMR_Patches · Patch

More vulnerabilities in openemr

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

openemr

open-emr

≤ 5.0.1.3

No fix yet

More vulnerabilities in openemr

See all →