Dhis2 / Dhis2-Core
14 CVEs
| CVE ID | Description | Severity | CVSS | Published |
|---|---|---|---|---|
| CVE-2026-55083 | DHIS2: Unsafe Java Deserialization - Remote Code Execution (RCE) | CRITICAL | 9.1 | Oct 1, 2026 |
| CVE-2026-55082 | DHIS2 SQL injection in SQL View filter values | HIGH | 8.7 | Jul 21, 2026 |
| CVE-2026-55081 | DHIS2 Reflected XSS in OpenAPI HTML scope parameter | HIGH | 7.3 | Jul 21, 2026 |
| CVE-2026-55084 | SQL Injection in SqlView Filter Parameter Leading to Arbitrary Database Read | HIGH | 8.8 | Jul 21, 2026 |
| CVE-2023-32060 | DHIS2 Core Improper Access Control with Category Option Combination sharing in /api/trackedEntityInstance and /api/events | MEDIUM | 6.5 | May 9, 2023 |
| CVE-2023-31139 | DHIS2 Core unrestricted session cookies with Personal Access Tokens | HIGH | 7.5 | May 9, 2023 |
| CVE-2023-31138 | DHIS2 Core vulnerable to Improper Access Control with PATCH requests | HIGH | 7.1 | May 9, 2023 |
| CVE-2022-41947 | Cross-site Scripting with user-uploaded files in dhis2-core | MEDIUM | 5.4 | Dec 8, 2022 |
| CVE-2022-41948 | Privilege Chaining with the user admin role in dhis2-core | HIGH | 7.2 | Dec 8, 2022 |
| CVE-2022-41949 | Semi-blind Server-Side Request Forgery in dhis2-core | MEDIUM | 5.0 | Dec 8, 2022 |
| CVE-2022-24848 | SQL Injection in DHIS2's in OrgUnit program association | HIGH | 8.8 | Jun 1, 2022 |
| CVE-2021-41187 | SQL Injection in DHIS2 Tracker API | HIGH | 8.8 | Nov 1, 2021 |
| CVE-2021-39179 | SQL Injection in DHIS2 Tracker API | HIGH | 8.8 | Oct 29, 2021 |
| CVE-2021-32704 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in dhis2-core | HIGH | 8.8 | Jun 24, 2021 |
Showing 1 to 14 of 14 CVEs