Raw vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:HCVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.
Summary
CVE-2026-33914 is a high-severity SQL Injection (CWE-89) vulnerability in Open-Emr Openemr. Its CVSS base score is 7.2 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Compromise Infrastructure (T1584); ranked at the 45th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified map to SA-11 (Developer Testing and Evaluation) and SI-10 (Information Input Validation) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2026-33914 is a blind SQL injection vulnerability in the PostCalendar module of OpenEMR, a free and open source electronic health records and medical practice management application. The issue affects versions prior to 8.0.0.3 and resides in the `categoriesUpdate` administrative function, where the `dels` POST parameter is processed via `pnVarCleanFromInput()`. This function only strips HTML tags without performing SQL escaping, allowing the unsanitized value to be directly interpolated into a raw SQL `DELETE` statement executed through Doctrine DBAL's `executeStatement()` method. The vulnerability is classified under CWE-89 with a CVSS v3.1 base score of 7.2 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).
Exploitation requires network access and high privileges (PR:H), typically administrative access to the affected OpenEMR instance. An attacker can submit a crafted `dels` POST parameter to the `categoriesUpdate` endpoint, triggering blind SQL injection in the DELETE query. This enables arbitrary SQL execution, potentially leading to high-impact confidentiality breaches (e.g., data exfiltration via blind techniques), integrity violations (e.g., unauthorized deletions or modifications), and availability disruptions (e.g., denial of service through destructive queries).
The vulnerability is patched in OpenEMR version 8.0.0.3, as detailed in the project's security advisory (GHSA-rq3v-38x5-3rm5), release notes, and the fixing commit. Security practitioners should upgrade to 8.0.0.3 or later and review access controls for administrative functions in the PostCalendar module to mitigate risks until patching is complete.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-16028
Vulnerability Data
OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 8.0.0.3, the PostCalendar module contains a blind SQL injection vulnerability in the `categoriesUpdate` administrative function. The `dels` POST parameter is read via…
more
`pnVarCleanFromInput()`, which only strips HTML tags and performs no SQL escaping. The value is then interpolated directly into a raw SQL `DELETE` statement that is executed unsanitized via Doctrine DBAL's `executeStatement()`. Version 8.0.0.3 patches the issue.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
—
V6.2.5
Mitigating Controls (NIST 800-53 r5) AI
Developer testing and evaluation can discover SQLi flaws before deployment but does not stop their introduction.
Input validation directly stops untrusted data from reaching SQL query construction without neutralization.
Secure engineering principles require parameterized queries and input sanitization that structurally eliminate SQLi.
System monitoring can identify attempted SQLi exploitation via anomalous queries after the weakness exists.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC practices directly target injection flaws during coding and review so largely prevent CWE-89 introduction, yet the single broad outcome leaves residual risk from incomplete neutralization techniques or missed edge cases.
Training raises developer awareness of SQLi risks and can reduce introduction likelihood (partial) but removes none of the actual coding flaw's risk by itself since technical neutralization is still required.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
The same secure-coding and static-analysis activities surface missing neutralization of SQL metacharacters before the system is accepted.
Language-specific secure coding rules, peer review and SAST together prevent the construction of SQL statements from untrusted data without proper parameterization or escaping.
created from the owner's anchor; an owner grade is a row and does not wait for an instrument (Mythos 2026-09-29T15:58Z).