CVE-2026-126489

OpenEMR before 8.5.0 SQL Injection via IPPF Contraceptive Issue Feature

OpenEMR before 8.5.0 contains a second-order SQL injection vulnerability in the IPPF contraceptive issue feature because issue_ippf_con_save concatenates layout_options field_id values into a REPLACE INTO query as column names. Authenticated administrators can add a malicious field_id via edit_layout.php, then trigger issue_ippf_con_save through add_edit_issue.php to execute arbitrary SQL.

CVSS 4.0 · 8.6 High EPSS n/a KEV · Not listed

Vendors

Open-emr

Products

Openemr

CVE-2026-126490

OpenEMR before 8.5.0 Information Disclosure via Debug Code in fax_view.php

OpenEMR before 8.5.0 contains active debug code in interface/fax/fax_view.php that executes passthru("groups") and discloses the web server's Unix group memberships. Authenticated attackers with fax module access can supply a nonexistent jid value to reveal groups such as adm or shadow, aiding privilege escalation planning.

CVSS 4.0 · 2.3 Low EPSS n/a KEV · Not listed

Vendors

Open-emr

Products

Openemr

CVE-2026-126491

OpenEMR before 8.5.0 SQL Injection via getByPatientDemographics in patient.inc.php

OpenEMR before 8.5.0 contains a stored SQL injection vulnerability in getByPatientDemographics() where layout_options field_id values are concatenated into the patient search WHERE clause. Attackers with Layout Editor access can plant a malicious field_id, allowing any authenticated low-privilege user to exfiltrate data from patient_data and users_secure tables.

CVSS 4.0 · 8.3 High EPSS n/a KEV · Not listed

Vendors

Open-emr

Products

Openemr

CVE-2026-126492

OpenEMR before 8.5.0 Second-Order SQL Injection via dynamic_finder.php

OpenEMR before 8.5.0 contains a second-order sql injection vulnerability that allows low-privileged authenticated users to store malicious SQL via library/ajax/addlistitem.php. Attackers can persist a SQL fragment in the recent_patient_columns option_id value, which dynamic_finder.php concatenates into a SELECT query and executes as SQL.

CVSS 4.0 · 7.1 High EPSS n/a KEV · Not listed

Vendors

Open-emr

Products

Openemr

CVE-2026-126493

OpenEMR before 8.5.0 Stored XSS via OnsitePortalActivity tableArgs

OpenEMR before 8.5.0 contains a stored cross-site scripting vulnerability that allows low-privileged patient portal users to inject JavaScript via the tableArgs field of the onsiteportalactivity API. Attackers can store a payload with spaces that breaks out of an unquoted data-delete-id attribute, executing script when providers click the delete button on the audit review page.

CVSS 4.0 · 4.8 Medium EPSS n/a KEV · Not listed

Vendors

Open-emr

Products

Openemr

CVE-2026-126494

OpenEMR before 8.4.0 Privilege Escalation via SMART/OAuth Scope Finalization

OpenEMR before 8.4.0 contains an improper authorization vulnerability in ScopeRepository::finalizeScopes() that allows read-only SMART/OAuth clients to obtain write scopes because ScopeEntity::containsScope() ignores registered permissions. Attackers with a client registered for user/<resource>.read can request user/<resource>.write to create, update, and delete appointments or patient data.

CVSS 4.0 · 7.1 High EPSS n/a KEV · Not listed

Vendors

Open-emr

Products

Openemr

CVE-2026-126936

Zipline before 4.7.0 Race Condition in Invite and Quota Limits

Zipline before 4.7.0 contains a race condition vulnerability that allows users to bypass invitation usage limits, upload storage quotas, and shortened-URL quotas through concurrent requests. Attackers can send overlapping registration, upload, or URL creation requests that pass checks against stale state, creating extra accounts and exceeding administrator-configured resource quotas.

CVSS 4.0 · 6 Medium EPSS n/a KEV · Not listed

Vendors

—

Products

—

CVE-2026-126937

Zipline before 4.6.5 TOCTOU Race Condition via /api/setup

Zipline before 4.6.5 contains a TOCTOU race condition in the POST /api/setup endpoint that allows unauthenticated attackers to create multiple SUPERADMIN accounts by racing concurrent requests before the firstSetup flag is reset. Attackers can send simultaneous requests with spoofed X-Forwarded-For headers during the argon2 hashing window to gain full administrative control of the instance.

CVSS 4.0 · 9.2 Critical EPSS n/a KEV · Not listed

Vendors

—

Products

—

CVE-2026-126938

Zipline before 4.6.4 Upload Quota Bypass via Forged Content-Range Headers

Zipline before 4.6.4 contains a resource allocation vulnerability that allows authenticated users to bypass chunked-upload size and quota checks by forging Content-Range offsets and totals. Attackers can send tiny chunks to the partial upload endpoint with large declared offsets, causing the server to create oversized files and exhaust disk space.

CVSS 4.0 · 7.1 High EPSS n/a KEV · Not listed

Vendors

—

Products

—

CVE-2026-126939

Zipline before 4.6.4 Unauthenticated File Listing via page Query Parameter

Zipline before 4.6.4 contains an information disclosure vulnerability in GET /api/server/folder/:id that allows unauthenticated attackers to list files in non-public upload-only folders. Attackers who know the folder UUID can supply the page query parameter to bypass the metadata-only early return and enumerate file names, IDs, MIME types, sizes, and view counts.

CVSS 4.0 · 6.9 Medium EPSS n/a KEV · Not listed

Vendors

—

Products

—

CVE-2026-126940

Zipline before 4.6.4 Rate Limit Bypass via Query String and Header

Zipline before 4.6.4 contains a rate limit bypass vulnerability that allows remote attackers to evade request limits by varying query strings or supplying the x-zipline-p-filename header. Attackers can append differing query parameters to login and file or short-link password verification endpoints to perform credential guessing beyond the intended rate limits.

CVSS 4.0 · 6.9 Medium EPSS n/a KEV · Not listed

Vendors

—

Products

—

CVE-2026-126941

Zipline through 4.6.2 Privilege Escalation via Missing Role Checks on User Endpoints

Zipline through 4.6.2 contains an authorization bypass vulnerability that allows authenticated administrators to read superadmin secrets because GET /api/users and GET /api/users/:id lack the canInteract check. Attackers can retrieve plaintext totpSecret and OAuth tokens to bypass 2FA and take over superadmin accounts, while any authenticated user can enumerate other users' folders via GET /api/user/folders.

CVSS 4.0 · 8.2 High EPSS n/a KEV · Not listed

Vendors

—

Products

—

CVE-2026-126942

Zipline before 4.6.2 Missing Authorization via POST /api/user/folders

Zipline before 4.6.2 contains a missing authorization vulnerability in POST /api/user/folders that allows authenticated users to reparent other users' files by supplying their file IDs. Attackers can harvest file IDs from public folders and create a folder seeded with them, disclosing victims' file URLs and removing those files from their folder views.

CVSS 4.0 · 5.3 Medium EPSS n/a KEV · Not listed

Vendors

—

Products

—

CVE-2026-126943

Zipline 4.2.0 before 4.6.2 OAuth2 Client Secret Leakage in Startup Logs

Zipline from 4.2.0 before 4.6.2 contains an information disclosure vulnerability that logs sensitive environment variable values, such as OAUTH_OIDC_CLIENT_SECRET, without redaction at startup. Attackers with access to system journal or docker logs can obtain OAuth2 client secrets and use them to exchange intercepted OAuth2 callbacks for valid tokens.

CVSS 4.0 · 6.9 Medium EPSS n/a KEV · Not listed

Vendors

—

Products

—

CVE-2026-126944

Zipline before 4.6.1 Path Traversal via Imported Filenames in LocalDatasource

Zipline before 4.6.1 contains a path traversal vulnerability in LocalDatasource that allows SUPERADMIN users to read or delete files outside the upload directory by importing records with traversal filenames. Attackers can trigger the unchecked range-read path with byte-range requests or set expired deletion times to delete files accessible to the Zipline process.

CVSS 4.0 · 5.8 Medium EPSS n/a KEV · Not listed

Vendors

—

Products

—

CVE-2026-126945

Zipline before 4.5.1 Stored XSS via HighlightCode Component

Zipline before 4.5.1 contains a stored cross-site scripting vulnerability in the HighlightCode component that renders unescaped file content before highlight.js finishes loading. Authenticated attackers can upload text files containing HTML/JavaScript payloads that execute in viewers' browsers, enabling API calls such as account changes on the victim's behalf.

CVSS 4.0 · 9.3 Critical EPSS n/a KEV · Not listed

Vendors

—

Products

—

CVE-2026-126946

Zipline 4.3.0 before 4.5.0 Stored XSS via SSR Embed Meta Tags

Zipline from 4.3.0 before 4.5.0 contains a stored cross-site scripting vulnerability that allows authenticated low-privilege users to inject HTML through unescaped embed settings in SSR meta tags. Attackers can set malicious embedTitle, embedDescription, embedSiteName, or embedColor values via PATCH /api/user to execute JavaScript in browsers of visitors opening their file view pages.

CVSS 4.0 · 5.1 Medium EPSS n/a KEV · Not listed

Vendors

—

Products

—

CVE-2026-126947

Zipline before 4.5.0 Stored Open Redirect via POST /api/user/urls

Zipline before 4.5.0 contains a stored open redirect vulnerability that allows authenticated users to set arbitrary short URL destinations by abusing missing scheme validation in POST /api/user/urls. Attackers can store javascript: URIs or attacker-controlled URLs as destinations, causing visitors of the trusted short link to be redirected to phishing or malware pages.

CVSS 4.0 · 5.1 Medium EPSS n/a KEV · Not listed

Vendors

—

Products

—

CVE-2026-126948

Zipline before 4.5.0 IDOR via Folder PATCH and DELETE Endpoints

Zipline before 4.5.0 contains an insecure direct object reference vulnerability caused by missing ownership verification in the PATCH and DELETE handlers for /api/user/folders/:id. Authenticated attackers can supply another user's folder ID to rename it, make it public, enable uploads, or delete it.

CVSS 4.0 · 8.7 High EPSS n/a KEV · Not listed

Vendors

—

Products

—

CVE-2026-126949

Zipline through 4.4.0 Path Traversal File Overwrite via PATCH /api/user/files/:id

Zipline through 4.4.0 contains a path traversal vulnerability in the PATCH /api/user/files/:id rename endpoint that allows authenticated users to overwrite existing uploads by supplying unsanitized names. Attackers can submit names like ../uploads/victim.txt that bypass the raw-string database uniqueness check but normalize via path.join(), causing fs.rename() to replace other files' contents.

CVSS 4.0 · 7 High EPSS n/a KEV · Not listed

Vendors

—

Products

—