CVE-2023-32060

DHIS2 Core contains the service layer and Web API for DHIS2, an information system for data capture. Starting in the 2.35 branch and prior to versions 2.36.13, 2.37.8, 2.38.2, and 2.39.0, when the Category Option Combination Sharing settings are configured to control access to specific tracker...

CVE-2021-41187

DHIS 2 is an information system for data capture, management, validation, analytics and visualization. A SQL injection security vulnerability has been found in specific versions of DHIS2. This vulnerability affects the API endpoints for /api/trackedEntityInstances and api/events in DHIS2. The...

CVE-2021-41187: Improper Neutralization of Special Elements used in an SQL Command

DHIS 2 is an information system for data capture, management, validation, analytics and visualization. A SQL injection security vulnerability has been found in specific versions of DHIS2. This vulnerability affects the API endpoints for /api/trackedEntityInstances and api/events in DHIS2. The...

PT-2021-23160

Name of the Vulnerable Software and Affected Versions DHIS2 versions 2.32 through 2.36 Description DHIS2 is an information system for data capture, management, validation, analytics, and visualization. A SQL injection security issue has been found in specific versions of DHIS2, affecting the API...

CVE-2021-39179: Improper Neutralization of Special Elements used in an SQL Command

DHIS 2 is an information system for data capture, management, validation, analytics and visualization. A SQL Injection vulnerability in the Tracker component in DHIS2 Server allows authenticated remote attackers to execute arbitrary SQL commands via unspecified vectors. This vulnerability affects...

PT-2021-22437

Name of the Vulnerable Software and Affected Versions DHIS2 versions 2.32 through 2.36 Description A SQL Injection vulnerability in the Tracker component in DHIS2 Server allows authenticated remote attackers to execute arbitrary SQL commands via unspecified vectors, affecting the...

CVE-2021-32704

DHIS 2 is an information system for data capture, management, validation, analytics and visualization. A SQL injection security vulnerability has been found in specific versions of DHIS2. This vulnerability affects the /api/trackedEntityInstances API endpoint in DHIS2 versions 2.34.4, 2.35.2,...

PT-2021-19870

Name of the Vulnerable Software and Affected Versions DHIS2 versions 2.34.4, 2.35.2, 2.35.3, 2.35.4, and 2.36.0 Description A SQL injection security issue has been found in DHIS2, affecting the "/api/trackedEntityInstances" API endpoint. This issue can be exploited by logged-in users, allowing th...

CVE-2021-32704: Improper Neutralization of Special Elements used in an SQL Command

DHIS 2 is an information system for data capture, management, validation, analytics and visualization. A SQL injection security vulnerability has been found in specific versions of DHIS2. This vulnerability affects the /api/trackedEntityInstances API endpoint in DHIS2 versions 2.34.4, 2.35.2,...