VendorsDHIS 2dhis_2all versions
Vulnerabilities

DHIS 2 (District Health Information Software 2)

Ranked by severity, then by exploit likelihood. Click a CVE ID for its full record.

10CVEs
CVE-2021-39179
SQL Injection in DHIS2 Tracker API
Published 2021-10-29 · Modified
8.8EPSS 0.019
CVE-2022-24848
SQL Injection in DHIS2's in OrgUnit program association
Published 2022-06-01 · Modified
8.8EPSS 0.011
CVE-2021-41187
SQL Injection in DHIS2 Tracker API
Published 2021-11-01 · Modified
8.8EPSS 0.009
CVE-2021-32704
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in dhis2-core
Published 2021-06-24 · Modified
8.8EPSS 0.008
CVE-2023-31139
DHIS2 Core unrestricted session cookies with Personal Access Tokens
Published 2023-05-09 · Modified
7.5EPSS 0.006
CVE-2022-41948
Privilege Chaining with the user admin role in dhis2-core
Published 2022-12-08 · Modified
7.2EPSS 0.006
CVE-2023-31138
DHIS2 Core vulnerable to Improper Access Control with PATCH requests
Published 2023-05-09 · Modified
7.1EPSS 0.006
CVE-2023-32060
DHIS2 Core Improper Access Control with Category Option Combination sharing in /api/trackedEntityInstance and /api/events
Published 2023-05-09 · Modified
6.5EPSS 0.005
CVE-2022-41947
Cross-site Scripting with user-uploaded files in dhis2-core
Published 2022-12-08 · Modified
5.4EPSS 0.004
CVE-2022-41949
Semi-blind Server-Side Request Forgery in dhis2-core
Published 2022-12-08 · Modified
5.0EPSS 0.004