Skip to content
OpenAdvisories

Vendor

dhis2

14 known vulnerabilities.

Products

dhis2-core 14
All Critical High Medium Low Exploited only Public exploit

8 results · Clear filters · Feed

  • High 8.7
    CVE-2026-55082

    DHIS2 SQL injection in SQL View filter values

    DHIS2 is a flexible information system for data capture, management, validation, analytics and visualization. DHIS2 SQL View data endpoints allowed authenticated users with SQL View access to provide crafted filter values that were interpolated into generated…

    dhis2 dhis2-core
  • High 7.3
    CVE-2026-55081

    DHIS2 Reflected XSS in OpenAPI HTML scope parameter

    DHIS2 is a flexible information system for data capture, management, validation, analytics and visualization. The DHIS2 OpenAPI HTML endpoint reflected values from the `scope` query parameter into the generated HTML document without sufficient sanitization. A…

    dhis2 dhis2-core
  • High 8.8
    CVE-2026-55084

    SQL Injection in SqlView Filter Parameter Leading to Arbitrary Database Read

    DHIS2 is a flexible information system for data capture, management, validation, analytics and visualization. A SQL injection vulnerability was identified in the SqlView API endpoint of the DHIS2 application in the `filter` parameter used by the `/api/sqlView…

    dhis2 dhis2-core
  • High 7.1
    CVE-2023-31138

    DHIS2 Core vulnerable to Improper Access Control with PATCH requests

    DHIS2 Core contains the service layer and Web API for DHIS2, an information system for data capture. Starting in the 2.36 branch and prior to versions 2.37.9.1, 2.38.3.1, and 2.39.1.2, using object model traversal in the payload of a PATCH request, authentica…

    dhis2 dhis2-core
  • High 8.8
    CVE-2022-24848

    SQL Injection in DHIS2's in OrgUnit program association

    DHIS2 is an information system for data capture, management, validation, analytics and visualization. A SQL injection security vulnerability affects the `/api/programs/orgUnits?programs=` API endpoint in DHIS2 versions prior to 2.36.10.1 and 2.37.6.1. The sys…

    dhis2 dhis2-core
  • High 8.1
    CVE-2021-41187

    SQL Injection in DHIS2 Tracker API

    DHIS 2 is an information system for data capture, management, validation, analytics and visualization. A SQL injection security vulnerability has been found in specific versions of DHIS2. This vulnerability affects the API endpoints for /api/trackedEntityInst…

    dhis2 dhis2-core
  • High 8.8
    CVE-2021-39179

    SQL Injection in DHIS2 Tracker API

    DHIS 2 is an information system for data capture, management, validation, analytics and visualization. A SQL Injection vulnerability in the Tracker component in DHIS2 Server allows authenticated remote attackers to execute arbitrary SQL commands via unspecifi…

    dhis2 dhis2-core
  • High 8.5
    CVE-2021-32704

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in dhis2-core

    DHIS 2 is an information system for data capture, management, validation, analytics and visualization. A SQL injection security vulnerability has been found in specific versions of DHIS2. This vulnerability affects the /api/trackedEntityInstances API endpoint…

    dhis2 dhis2-core