Ddhis2

Products

Exploited and recent CVEs

• CVE-2026-55083 Critical 9.1 DHIS2: Unsafe Java Deserialization - Remote Code Execution (RCE) 0.6%
• CVE-2026-55082 High 8.7 DHIS2 SQL injection in SQL View filter values 0.6%
• CVE-2026-55081 High 7.3 DHIS2 Reflected XSS in OpenAPI HTML scope parameter 0.4%
• CVE-2026-55084 High 8.8 SQL Injection in SqlView Filter Parameter Leading to Arbitrary Database Read 0.5%
• CVE-2023-32060 Medium 6.5 DHIS2 Core Improper Access Control with Category Option Combination sharing in /api/trackedEntityInstance and /api/events 0.5%
• CVE-2023-31139 Medium 4.3 DHIS2 Core unrestricted session cookies with Personal Access Tokens 0.6%
• CVE-2023-31138 High 7.1 DHIS2 Core vulnerable to Improper Access Control with PATCH requests 0.6%
• CVE-2022-41947 Medium 5.4 Cross-site Scripting with user-uploaded files in dhis2-core 0.4%
• CVE-2022-41948 Medium 6.7 Privilege Chaining with the user admin role in dhis2-core 0.6%
• CVE-2022-41949 Medium 5.0 Semi-blind Server-Side Request Forgery in dhis2-core 0.4%
• CVE-2022-24848 High 8.8 SQL Injection in DHIS2's in OrgUnit program association 1.2%
• CVE-2021-41187 High 8.1 SQL Injection in DHIS2 Tracker API 0.9%
• CVE-2021-39179 High 8.8 SQL Injection in DHIS2 Tracker API 1.9%
• CVE-2021-32704 High 8.5 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in dhis2-core 0.8%