Threats tagged 'ghsa-hf2c-h9g2-rf29'

OpenEMR versions prior to 8.5.0 have an SQL injection vulnerability in the patient portal's OnsiteDocument.Query endpoint. This flaw allows authenticated patients to inject SQL commands beyond their own data scope, potentially exposing the entire database including other patients' personal information and password hashes.