openDCIM vulnerabilities
We track 3 vulnerabilities in openDCIM products. 3 are rated high or critical, and none are known to be exploited. The most recent was published on February 27, 2026.
Latest openDCIM vulnerabilities
- 9.8 Critical severity
openDCIM: Improper Neutralization of Special Elements used in an OS Command
openDCIM version 23.04, through commit 4467e9c4, contains an OS command injection vulnerability in report_network_map.php. The application retrieves the 'dot' configuration parameter from the database and passes it directly to exec() without validation or sani
- 8.8 High severity
openDCIM: Improper Neutralization of Special Elements used in an SQL Command
openDCIM version 23.04, through commit 4467e9c4, contains a SQL injection vulnerability in Config::UpdateParameter. The install.php and container-install.php handlers pass user-supplied input directly into SQL statements using string interpolation without prep
- 8.8 High severity
openDCIM: Missing Authorization
openDCIM version 23.04, through commit 4467e9c4, contains a missing authorization vulnerability in install.php and container-install.php. The installer and upgrade handler expose LDAP configuration functionality without enforcing application role checks. Any a