CVE-2026-33914: Open-EMR Openemr

High severity, CVSS 7.2. EPSS: 0.5% chance of exploitation in the next 30 days.

OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 8.0.0.3, the PostCalendar module contains a blind SQL injection vulnerability in the `categoriesUpdate` administrative function. The `dels` POST parameter is read via `pnVarCleanFromInput()`, which only strips HTML tags and performs no SQL escaping. The value is then interpolated directly into a raw SQL `DELETE` statement that is executed unsanitized via Doctrine DBAL's `executeStatement()`. Version 8.0.0.3 patches the issue.

Affected products

• Open-EMR Openemr: before 8.0.0.3 (fixed in 8.0.0.3)

Published 2026-03-26. Last modified 2026-06-17.