Advisories · Technology
dhis2-core.
Every CVE that names dhis2-core among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 9.1 CriticalCritical · CVSS 9+
DHIS2: Unsafe Java Deserialization - Remote Code Execution (RCE)
- dhis2-core
- Insecure deserialization
- CVSS 8.7 High
DHIS2 SQL injection in SQL View filter values
- dhis2-core
- SQL injection
- CVSS 7.3 High
DHIS2 Reflected XSS in OpenAPI HTML scope parameter
- dhis2-core
- Cross-site scripting (XSS)
- CVSS 8.8 High
SQL Injection in SqlView Filter Parameter Leading to Arbitrary Database Read
- dhis2-core
- SQL injection
- CVSS 6.5 Medium
DHIS2 Core Improper Access Control with Category Option Combination sharing in /api/trackedEntityInstance and /api/events
- dhis2-core
- Broken access control
- CVSS 4.3 Medium
DHIS2 Core unrestricted session cookies with Personal Access Tokens
- dhis2-core
- Authentication bypass
- CVSS 7.1 High
DHIS2 Core vulnerable to Improper Access Control with PATCH requests
- dhis2-core
- Broken access control
- CVSS 5.4 Medium
Cross-site Scripting with user-uploaded files in dhis2-core
- dhis2-core
- Cross-site scripting (XSS)
- CVSS 6.7 Medium
Privilege Chaining with the user admin role in dhis2-core
- dhis2-core
- Privilege escalation
- CVSS 5.0 Medium
Semi-blind Server-Side Request Forgery in dhis2-core
- dhis2-core
- Server-side request forgery (SSRF)
- CVSS 8.8 High
SQL Injection in DHIS2's in OrgUnit program association
- dhis2-core
- SQL injection
- CVSS 8.1 High
SQL Injection in DHIS2 Tracker API
- dhis2-core
- SQL injection
- CVSS 8.8 High
SQL Injection in DHIS2 Tracker API
- dhis2-core
- SQL injection
- CVSS 8.5 High
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in dhis2-core
- dhis2-core
- SQL injection