dhis2-core vulnerabilities

14 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 4 published in the last 12 months.

Latest dhis2-core vulnerabilities

CVE-2026-55083 — DHIS2: Unsafe Java Deserialization - Remote Code Execution (RCE) (CVSS 9.1)
CVE-2026-55084 — SQL Injection in SqlView Filter Parameter Leading to Arbitrary Database Read (CVSS 8.8)
CVE-2026-55082 — DHIS2 SQL injection in SQL View filter values (CVSS 8.7)
CVE-2026-55081 — DHIS2 Reflected XSS in OpenAPI HTML scope parameter (CVSS 7.3)
CVE-2023-32060 — DHIS2 Core Improper Access Control with Category Option Combination sharing in /api/trackedEntityInstance and /api/events (CVSS 6.5)
CVE-2023-31139 — DHIS2 Core unrestricted session cookies with Personal Access Tokens (CVSS 7.5)
CVE-2023-31138 — DHIS2 Core vulnerable to Improper Access Control with PATCH requests (CVSS 6.5)
CVE-2022-41948 — Privilege Chaining with the user admin role in dhis2-core (CVSS 7.2)
CVE-2022-41947 — Cross-site Scripting with user-uploaded files in dhis2-core (CVSS 5.4)
CVE-2022-41949 — Semi-blind Server-Side Request Forgery in dhis2-core (CVSS 4.3)
CVE-2022-24848 — SQL Injection in DHIS2's in OrgUnit program association (CVSS 8.8)
CVE-2021-41187 — SQL Injection in DHIS2 Tracker API (CVSS 8.8)
CVE-2021-39179 — SQL Injection in DHIS2 Tracker API (CVSS 6.5)
CVE-2021-32704 — Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in dhis2-core (CVSS 8.8)