Dhis2 vulnerabilities
We track 7 vulnerabilities in Dhis2 products across 2 products. 7 are rated high or critical, and none are known to be exploited. The most recent was published on October 1, 2026.
Latest Dhis2 vulnerabilities
- 9.1 Critical severity
dhis2-core: Deserialization of Untrusted Data
DHIS2 is a flexible information system for data capture, management, validation, analytics and visualization. From versions 2.42.0 to before 2.42.5.1, and from versions 2.43.0 to before 2.43.0.1, DHIS2 is vulnerable to remote code execution (RCE) via unsafe Ja
- 8.8 High severity
dhis2-core: Improper Neutralization of Special Elements used in an SQL Command
DHIS2 is a flexible information system for data capture, management, validation, analytics and visualization. A SQL injection vulnerability was identified in the SqlView API endpoint of the DHIS2 application in the `filter` parameter used by the `/api/sqlViews
- 8.7 High severity
dhis2-core: Improper Neutralization of Special Elements used in an SQL Command
DHIS2 is a flexible information system for data capture, management, validation, analytics and visualization. DHIS2 SQL View data endpoints allowed authenticated users with SQL View access to provide crafted filter values that were interpolated into generated
- 7.3 High severity
dhis2-core: Improper Neutralization of Input During Web Page Generation
DHIS2 is a flexible information system for data capture, management, validation, analytics and visualization. The DHIS2 OpenAPI HTML endpoint reflected values from the `scope` query parameter into the generated HTML document without sufficient sanitization. A
- 7.5 High severity
DHIS2 Core contains the service layer and Web API for DHIS2, an information system for data…
DHIS2 Core contains the service layer and Web API for DHIS2, an information system for data capture. Starting in the 2.37 branch and prior to versions 2.37.9.1, 2.38.3.1, and 2.39.1.2, Personal Access Tokens (PATs) generate unrestricted session cookies. This m
- 7.2 High severity
dhis2-core: Improper Privilege Management
DHIS 2 is an open source information system for data capture, management, validation, analytics and visualization. Affected versions are subject to a privilege escalation vulnerability. A DHIS2 user with authority to manage users can assign superuser privilege
- 8.8 High severity
dhis2-core: Improper Neutralization of Special Elements used in an SQL Command
DHIS2 is an information system for data capture, management, validation, analytics and visualization. A SQL injection security vulnerability affects the `/api/programs/orgUnits?programs=` API endpoint in DHIS2 versions prior to 2.36.10.1 and 2.37.6.1. The syst