Advisories · Technology

openDCIM.

Every CVE that names openDCIM among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.

CVE-2026-28517 CVE record

CVSS 9.3 CriticalCritical · CVSS 9+, CVSS 7+ and EPSS

openDCIM <= 23.04 OS Command Injection via dot Configuration Parameter
- openDCIM
- Command injection
Not analysed yet 27 Feb 2026
CVE-2026-28516 CVE record

CVSS 9.3 CriticalCritical · CVSS 9+

openDCIM <= 23.04 SQL Injection in Config::UpdateParameter
- openDCIM
- SQL injection
Not analysed yet 27 Feb 2026
CVE-2026-28515 CVE record

CVSS 9.3 CriticalCritical · CVSS 9+

openDCIM <= 23.04 Missing Authorization in install.php
- openDCIM
- Broken access control
Not analysed yet 27 Feb 2026
CVE-2025-10253 CVE record

CVSS 5.1 Medium

openDCIM SVG File uploadifive.php cross site scripting
- openDCIM
- Cross-site scripting (XSS)
- Code injection
Not analysed yet 11 Sept 2025
CVE-2025-48701 CVE record

CVSS 5.4 Medium

SQL injection in openDCIM
- openDCIM
- SQL injection
Not analysed yet 23 May 2025