CVE-2018-9250

interface\super\edit_list.php in OpenEMR before v5_0_1_1 allows remote authenticated users to execute arbitrary SQL commands via the newlistname parameter.

• CWE-89

• https://github.com/openemr/openemr/commit/2a5dd0601e1f616251006d7471997ecd7aaf9651Patch, Third Party Advisory
• https://github.com/openemr/openemr/pull/1578Third Party Advisory
• https://github.com/openemr/openemr/commit/2a5dd0601e1f616251006d7471997ecd7aaf9651Patch, Third Party Advisory
• https://github.com/openemr/openemr/pull/1578Third Party Advisory

Published

May 18, 2018

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2018-9244GitLab Community and Enterprise Editions version 9.2 up to 1…
• CVE-2018-9245The Ericsson-LG iPECS NMS A.1Ac login portal has a SQL injec…
• CVE-2018-9246The PGObject::Util::DBAdmin module before 0.120.0 for Perl, …
• CVE-2018-9247The upsql function in \Lib\Lib\Action\Admin\DataAction.class…
• CVE-2018-9248FiberHome VDSL2 Modem HG 150-UB devices allow authentication…
• CVE-2018-9249FiberHome VDSL2 Modem HG 150-UB devices allow authentication…
• CVE-2018-9251The xz_decomp function in xzlib.c in libxml2 2.9.8, if --wit…
• CVE-2018-9252JasPer 2.0.14 allows denial of service via a reachable asser…
• CVE-2018-9256In Wireshark 2.4.0 to 2.4.5 and 2.2.0 to 2.2.13, the LWAPP d…
• CVE-2018-9257In Wireshark 2.4.0 to 2.4.5, the CQL dissector could go into…
• CVE-2018-9258In Wireshark 2.4.0 to 2.4.5, the TCP dissector could crash. …
• CVE-2018-9259In Wireshark 2.4.0 to 2.4.5 and 2.2.0 to 2.2.13, the MP4 dis…