The vulnerability in OpenEMR is a SQL injection flaw in the prescription listing feature, allowing authenticated attackers to inject arbitrary SQL statements. By exploiting insufficient input validation, an attacker can read, modify, or delete patient data, potentially compromising confidentiality, integrity, and availability of the information in the database.

All OpenEMR installations running versions prior to 8.0.0 are affected, including the standard OpenEMR 7.x series. The issue resides in the prescription controller module, which is part of the default OpenEMR application delivered by the primary vendor openemr:openemr.

The severity is high, with a CVSS score of 8.8, but the EPSS indicates a very low exploitation probability (<1%) and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires authenticated access, so environments with weak account controls or widespread user privileges are more at risk, while isolated or tightly controlled deployments may experience a lower likelihood of attack.