Dhis2 vulnerabilities

Products

• Dhis2-core 14
• Dhis 2 10

Newest

• dhis2 dhis2-core DHIS2: Unsafe Java Deserialization - Remote Code Execution (RCE) CVE-2026-55083 9.1 CriticalOctober 1, 2026
• dhis2 dhis2-core DHIS2 SQL injection in SQL View filter values CVE-2026-55082 8.7 HighJuly 21, 2026
• dhis2 dhis2-core DHIS2 Reflected XSS in OpenAPI HTML scope parameter CVE-2026-55081 7.3 HighJuly 21, 2026
• dhis2 dhis2-core SQL Injection in SqlView Filter Parameter Leading to Arbitrary Database Read CVE-2026-55084 8.8 HighJuly 21, 2026
• dhis2 dhis2-core, dhis 2 +1 more DHIS2 Core Improper Access Control with Category Option Combination sharing in /api/trackedEntityInstance and /api/events CVE-2023-32060 6.5 MediumMay 9, 2023
• dhis2 dhis2-core, dhis 2 +1 more DHIS2 Core unrestricted session cookies with Personal Access Tokens CVE-2023-31139 4.3 MediumMay 9, 2023
• dhis2 dhis2-core, dhis 2 +1 more DHIS2 Core vulnerable to Improper Access Control with PATCH requests CVE-2023-31138 7.1 HighMay 9, 2023
• dhis2 dhis2-core, dhis 2 +1 more Cross-site Scripting with user-uploaded files in dhis2-core CVE-2022-41947 5.4 MediumDecember 8, 2022
• dhis2 dhis2-core, dhis 2 +1 more Privilege Chaining with the user admin role in dhis2-core CVE-2022-41948 6.7 MediumDecember 8, 2022
• dhis2 dhis2-core, dhis 2 +1 more Semi-blind Server-Side Request Forgery in dhis2-core CVE-2022-41949 5.0 MediumDecember 8, 2022
• dhis2 dhis2-core, dhis 2 +1 more SQL Injection in DHIS2's in OrgUnit program association CVE-2022-24848 8.8 HighJune 1, 2022
• dhis2 dhis 2, dhis2-core +1 more SQL Injection in DHIS2 Tracker API CVE-2021-41187 8.1 HighNovember 1, 2021
• dhis2 dhis 2, dhis2-core +1 more SQL Injection in DHIS2 Tracker API CVE-2021-39179 8.8 HighOctober 29, 2021
• dhis2 dhis2-core, dhis 2 +1 more Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in dhis2-core CVE-2021-32704 8.5 HighJune 24, 2021