dhis2 records

10 published records for vendor dhis2.

Researcher profile

Entered KEV: 0 · 0%
Weaponized: 0 · 0%
Pre-auth RCE: 0
With a fix record: 0%
Median publish → KEV: No record has entered KEV

Records by year

Bar: total · dark part: CISA KEV.

Recurring classes

The weakness classes this vendor ships most often: where to look.

Attack profile

All records

10 records

CVE records
Action	CVE	Vulnerability	Severity	KEV	EPSS	Published
36Monitor	CVE-2021-39179No exploit	SQL Injection in DHIS2 Tracker APIdhis2 · dhis 2 · CWE-89 RCE SQL injection	High8.8	—	1.9%	Oct 29, 2021
35Monitor	CVE-2022-24848No exploit	SQL Injection in DHIS2's in OrgUnit program associationdhis2 · dhis 2 · CWE-89 SQL injection	High8.8	—	1.1%	Jun 1, 2022
35Monitor	CVE-2021-41187No exploit	SQL Injection in DHIS2 Tracker APIdhis2 · dhis 2 · CWE-89 SQL injection	High8.8	—	0.9%	Nov 1, 2021
35Monitor	CVE-2021-32704No exploit	Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in dhis2-coredhis2 · dhis 2 · CWE-89 SQL injection	High8.8	—	0.8%	Jun 24, 2021
30Monitor	CVE-2023-31139No exploit	DHIS2 Core unrestricted session cookies with Personal Access Tokensdhis2 · dhis 2 · CWE-613 Pre-auth	High7.5	—	0.6%	May 9, 2023
28Monitor	CVE-2022-41948No exploit	Privilege Chaining with the user admin role in dhis2-coredhis2 · dhis 2 · CWE-269	High7.2	—	0.6%	Dec 8, 2022
26Monitor	CVE-2023-31138No exploit	DHIS2 Core vulnerable to Improper Access Control with PATCH requestsdhis2 · dhis 2 · CWE-284 Broken access control (IDOR)	Medium6.5	—	0.6%	May 9, 2023
26Monitor	CVE-2023-32060No exploit	DHIS2 Core Improper Access Control with Category Option Combination sharing in /api/trackedEntityInstance and /api/eventsdhis2 · dhis 2 · CWE-284 Broken access control (IDOR)	Medium6.5	—	0.5%	May 9, 2023
21Monitor	CVE-2022-41947No exploit	Cross-site Scripting with user-uploaded files in dhis2-coredhis2 · dhis 2 · CWE-79 XSS	Medium5.4	—	0.4%	Dec 8, 2022
17Monitor	CVE-2022-41949No exploit	Semi-blind Server-Side Request Forgery in dhis2-coredhis2 · dhis 2 · CWE-918 SSRF	Medium4.3	—	0.4%	Dec 8, 2022

CVE-2021-39179
36Monitor
SQL Injection in DHIS2 Tracker API
HighCVSS 8.8No exploitEPSS 2%
- RCE
- SQL injection
dhis2 · dhis 2Oct 29, 2021
CVE-2022-24848
35Monitor
SQL Injection in DHIS2's in OrgUnit program association
HighCVSS 8.8No exploitEPSS 1%
- SQL injection
dhis2 · dhis 2Jun 1, 2022
CVE-2021-41187
35Monitor
SQL Injection in DHIS2 Tracker API
HighCVSS 8.8No exploitEPSS 1%
- SQL injection
dhis2 · dhis 2Nov 1, 2021
CVE-2021-32704
35Monitor
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in dhis2-core
HighCVSS 8.8No exploitEPSS 1%
- SQL injection
dhis2 · dhis 2Jun 24, 2021
CVE-2023-31139
30Monitor
DHIS2 Core unrestricted session cookies with Personal Access Tokens
HighCVSS 7.5No exploitEPSS 1%
- Pre-auth
dhis2 · dhis 2May 9, 2023
CVE-2022-41948
28Monitor
Privilege Chaining with the user admin role in dhis2-core
HighCVSS 7.2No exploitEPSS 1%
dhis2 · dhis 2Dec 8, 2022
CVE-2023-31138
26Monitor
DHIS2 Core vulnerable to Improper Access Control with PATCH requests
MediumCVSS 6.5No exploitEPSS 1%
- Broken access control (IDOR)
dhis2 · dhis 2May 9, 2023
CVE-2023-32060
26Monitor
DHIS2 Core Improper Access Control with Category Option Combination sharing in /api/trackedEntityInstance and /api/events
MediumCVSS 6.5No exploitEPSS 1%
- Broken access control (IDOR)
dhis2 · dhis 2May 9, 2023
CVE-2022-41947
21Monitor
Cross-site Scripting with user-uploaded files in dhis2-core
MediumCVSS 5.4No exploitEPSS 0%
- XSS
dhis2 · dhis 2Dec 8, 2022
CVE-2022-41949
17Monitor
Semi-blind Server-Side Request Forgery in dhis2-core
MediumCVSS 4.3No exploitEPSS 0%
- SSRF
dhis2 · dhis 2Dec 8, 2022