CVE-2018-1000650

8.8 highEPSS 1.5%

High (8.8) in librehealth librehealth ehr. EPSS 1.5% chance of exploitation in the next 30 days.

LibreHealthIO lh-ehr version REL-2.0.0 contains a SQL Injection vulnerability in Show Groups Popup SQL query functions that can result in Ability to perform malicious database queries. This attack appear to be exploitable via User controlled parameters.

Severity

CVSS 3.0

8.8 high

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS: 1.5% chance of exploitation in the next 30 days; higher than 74% of CVEs (scores of 2026-10-31)
CWE: CWE-89
Published: 2018-08-20
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

librehealth:librehealth_ehr

References

https://0dd.zone/2018/08/08/lh-ehr-Authenticated-SQL-Injection/
https://github.com/LibreHealthIO/lh-ehr/issues/1215
https://0dd.zone/2018/08/08/lh-ehr-Authenticated-SQL-Injection/
https://github.com/LibreHealthIO/lh-ehr/issues/1215

Check your stack JSON