CVE-2021-41843: Open-EMR Openemr

Medium severity, CVSS 6.5. EPSS: 12.7% chance of exploitation in the next 30 days.

An authenticated SQL injection issue in the calendar search function of OpenEMR 6.0.0 before patch 3 allows an attacker to read data from all tables of the database via the parameter provider_id, as demonstrated by the /interface/main/calendar/index.php?module=PostCalendar&func=search URI.

Affected products

• Open-EMR Openemr: version 6.0.0 only

Published 2021-12-17. Last modified 2026-06-17.