CVE-2020-13567: Open-EMR Openemr

Critical severity, CVSS 9.8. EPSS: 2.3% chance of exploitation in the next 30 days.

Multiple SQL injection vulnerabilities exist in phpGACL 3.3.7. A specially crafted HTTP request can lead to a SQL injection. An attacker can send an HTTP request to trigger this vulnerability.

Affected products

• Open-EMR Openemr: version 5.0.2 only; version 6.0.0 only
• Phpgacl Project Phpgacl: version 3.3.7 only

Published 2022-04-18. Last modified 2026-06-17.