CVE-2026-104135
6.5 MEDIUMpublic exploit availablePublished 2026-11-05 · Updated 2026-11-05
AI analysis for this CVE has not been generated yet. Raw NVD data is shown below.
NVD description
OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.3.0, library/ajax/payment_ajax.php validates a CSRF token but performs no AclMain authorization check before executing a wildcard search of patient_data. Any authenticated user, including a non-clinical role, can enumerate patient identifiers, full names, and dates of birth through the set_patient branch. This issue is fixed in version 8.3.0.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-862
Public exploit & PoC references
- https://github.com/openemr/openemr/commit/7973cab3fe3f2fd2374ed71c02605e3c93491c36
- https://github.com/openemr/openemr/pull/13200
- https://github.com/openemr/openemr/releases/tag/v8_3_0
- https://github.com/openemr/openemr/security/advisories/GHSA-4269-grc6-qr62
- https://github.com/openemr/openemr/security/advisories/GHSA-4269-grc6-qr62
All references
- https://github.com/openemr/openemr/commit/7973cab3fe3f2fd2374ed71c02605e3c93491c36
- https://github.com/openemr/openemr/pull/13200
- https://github.com/openemr/openemr/releases/tag/v8_3_0
- https://github.com/openemr/openemr/security/advisories/GHSA-4269-grc6-qr62
- https://github.com/openemr/openemr/security/advisories/GHSA-4269-grc6-qr62
Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.
Related CVEs
- MEDIUMCVE-2025-11455
- MEDIUMCVE-2025-12523PoC
- MEDIUMCVE-2025-1397
- MEDIUMCVE-2025-14484
- MEDIUMCVE-2025-14486
- MEDIUMCVE-2025-14487
- MEDIUMCVE-2025-7043
- HIGHCVE-2025-71433PoC
Related by shared AI tags and CWE weakness class. Browse the full archive.