CVE-2020-29139

A SQL injection vulnerability in interface/main/finder/patient_select.php from library/patient.inc in OpenEMR before 5.0.2.5 allows a remote authenticated attacker to execute arbitrary SQL commands via the searchFields parameter.

• CWE-89

• https://community.open-emr.org/t/openemr-6-0-0-has-been-released/15732Release Notes, Vendor Advisory
• https://murat.one/?p=70Exploit, Third Party Advisory
• https://nitroteam.kz/index.php?action=researches&slug=OpenEMR--9035Exploit, Third Party Advisory
• https://www.open-emr.org/wiki/index.php/OpenEMR_DownloadsRelease Notes, Vendor Advisory
• https://community.open-emr.org/t/openemr-6-0-0-has-been-released/15732Release Notes, Vendor Advisory
• https://murat.one/?p=70Exploit, Third Party Advisory
• https://nitroteam.kz/index.php?action=researches&slug=OpenEMR--9035Exploit, Third Party Advisory
• https://www.open-emr.org/wiki/index.php/OpenEMR_DownloadsRelease Notes, Vendor Advisory

Published

Feb 15, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-29133jsp/upload.jsp in Coremail XT 5.0 allows XSS via an uploaded…6.1
• CVE-2020-29134The TOTVS Fluig platform allows path traversal through the p…8.6
• CVE-2020-29135cPanel before 90.0.17 has multiple instances of URL paramete…4.1
• CVE-2020-29136In cPanel before 90.0.17, 2FA can be bypassed via a brute-fo…6.5
• CVE-2020-29137cPanel before 90.0.17 allows self-XSS via the WHM Transfer T…6.1
• CVE-2020-29138Incorrect Access Control in the configuration backup path in…5.3
• CVE-2020-2914Vulnerability in the Oracle VM VirtualBox product of Oracle …7
• CVE-2020-29140A SQL injection vulnerability in interface/reports/immunizat…7.2
• CVE-2020-29142A SQL injection vulnerability in interface/usergroup/usergro…7.2
• CVE-2020-29143A SQL injection vulnerability in interface/reports/non_repor…7.2
• CVE-2020-29144In Ericsson BSCS iX R18 Billing & Rating iX R18, MX is a web…5.4
• CVE-2020-29145In Ericsson BSCS iX R18 Billing & Rating iX R18, ADMX is a w…5.4