dhis2 dhis2-core vulnerabilities

CVEs per yearBy the year they were published

1. 20213
2. 20224
3. 20233
4. 20264

Newest CVEs

• CVE-2026-55083

  DHIS2: Unsafe Java Deserialization - Remote Code Execution (RCE)

  dhis2 · dhis2-core

  Critical9.1
• CVE-2026-55082

  DHIS2 SQL injection in SQL View filter values

  dhis2 · dhis2-core

  High8.7
• CVE-2026-55081

  DHIS2 Reflected XSS in OpenAPI HTML scope parameter

  dhis2 · dhis2-core

  High7.3
• CVE-2026-55084

  SQL Injection in SqlView Filter Parameter Leading to Arbitrary Database Read

  dhis2 · dhis2-core

  High8.8
• CVE-2023-32060

  DHIS2 Core Improper Access Control with Category Option Combination sharing in /api/trackedEntityInstance and /api/events

  dhis2 · dhis2-core

  Medium6.5
• CVE-2023-31139

  DHIS2 Core unrestricted session cookies with Personal Access Tokens

  dhis2 · dhis2-core

  Medium4.3
• CVE-2023-31138

  DHIS2 Core vulnerable to Improper Access Control with PATCH requests

  dhis2 · dhis2-core

  High7.1
• CVE-2022-41947

  Cross-site Scripting with user-uploaded files in dhis2-core

  dhis2 · dhis2-core

  Medium5.4
• CVE-2022-41948

  Privilege Chaining with the user admin role in dhis2-core

  dhis2 · dhis2-core

  Medium6.7
• CVE-2022-41949

  Semi-blind Server-Side Request Forgery in dhis2-core

  dhis2 · dhis2-core

  Medium5.0