CVE-2026-33914 Details
Description
OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 8.0.0.3, the PostCalendar module contains a blind SQL injection vulnerability in the `categoriesUpdate` administrative function. The `dels` POST parameter is read via `pnVarCleanFromInput()`, which only strips HTML tags and performs no SQL escaping. The value is then interpolated directly into a raw SQL `DELETE` statement that is executed unsanitized via Doctrine DBAL's `executeStatement()`. Version 8.0.0.3 patches the issue.
A blind SQL injection vulnerability has been identified in the PostCalendar module of OpenEMR, prior to version 8.0.0.3. The issue resides in the 'categoriesUpdate' administrative function, where the 'dels' POST parameter is processed by 'pnVarCleanFromInput()'. This function only removes HTML tags without escaping SQL special characters. Consequently, the unvalidated 'dels' parameter is directly inserted into a raw SQL DELETE statement, which is then executed unsanitized using Doctrine DBAL's 'executeStatement()'.
Users can update to OpenEMR version 8.0.0.3 or later, where this vulnerability has been patched.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Mar 26, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/openemr/openemr/commit/1b851fc9af84f181ad7a84210a168d0d568cd442 | [email protected] | Patch |
| https://github.com/openemr/openemr/releases/tag/v8_0_0_3 | [email protected] | ProductRelease Notes |
| https://github.com/openemr/openemr/security/advisories/GHSA-rq3v-38x5-3rm5 | [email protected] | ExploitMitigationVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-89 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| open-emr openemr | < 8.0.0.3 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Mar 26, 2026 | Initial Analysis | [email protected] |
| Mar 26, 2026 | New CVE Received | [email protected] |