CRITICALVulnerability
Verified
Global

NVD CRITICAL: CVE-2026-39932 — OpenEMR through 8.2.0 contains a remote code execution vulnerability in the docu...

·Source: NIST NVD

Updated:

Executive Summary

OpenEMR through 8.2.0 contains a remote code execution vulnerability in the document category tree component (library/classes/Tree.class.php) that allows authenticated administrators to execute arbitrary operating system commands by injecting PHP payloads into the categories database table. Attackers can chain arbitrary SQL execution to alter the id column type to VARCHAR and insert a malicious PH

Analysis

OpenEMR through 8.2.0 contains a remote code execution vulnerability in the document category tree component (library/classes/Tree.class.php) that allows authenticated administrators to execute arbitrary operating system commands by injecting PHP payloads into the categories database table. Attackers can chain arbitrary SQL execution to alter the id column type to VARCHAR and insert a malicious PHP payload, which is then executed via an unsanitized eval() call whenever any page instantiates CategoryTree, including unauthenticated and low-privilege pages, resulting in command execution as the web server user. CVSS Score: 9.1. Published: 2026-08-03T17:16:36.893.

Indicators of Compromise (1)

CVE (1)
CVE-2026-39932
NVDMITRE CVE
Source Attribution

Originally published by NIST NVD on Aug 3, 2026. Verified by: NIST.

Related Threats

CRITICALVulnerabilityNEW

NVD CRITICAL: CVE-2026-41452 — Krayin CRM 2.2.4 contains a missing authentication vulnerability in the installe...

Krayin CRM 2.2.4 contains a missing authentication vulnerability in the installer middleware that allows unauthenticated remote attackers to overwrite the primary administrator account by sending a crafted HTTP POST request with the X-Requested-With: XMLHttpRequest header to bypass the CanInstall middleware redirect check. Attackers can supply arbitrary name, email, and password values to the admi

CVE-2026-41452
NIST NVD
CRITICALVulnerabilityNEW

NVD CRITICAL: CVE-2026-18602 — A vulnerability was determined in GL.iNet GL-MT3000 up to 4.4.5. Affected is the...

A vulnerability was determined in GL.iNet GL-MT3000 up to 4.4.5. Affected is the function ovpn-client.get_recommend_config of the file /cgi-bin/glc of the component ovpn-client.so Native Plugin. Executing a manipulation of the argument Hostname can lead to command injection. The attack can be executed remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted e

CVE-2026-18602
NIST NVD
MEDIUMVulnerability

Patelco Credit Union invests in Payfinia CUSO

Payfinia, an independent payment services firm providing an open payments framework, today announced a strategic partnership with Dublin, Calif.-based Patelco Credit Union (‘Patelco’ – $9.5 billion in assets and more than 550,000 members), marked by the credit union’s investment* in the Payfinia Credit Union Service Organization (CUSO).

Finextra