CVE-2026-55084

DHIS2 is a flexible information system for data capture, management, validation, analytics and visualization. A SQL injection vulnerability was identified in the SqlView API endpoint of the DHIS2 application in the filter parameter used by the /api/sqlViews/viewId/data.json endpoint. An...

CVE-2026-55082

DHIS2 is a flexible information system for data capture, management, validation, analytics and visualization. DHIS2 SQL View data endpoints allowed authenticated users with SQL View access to provide crafted filter values that were interpolated into generated SQL. An authenticated user with acces...

CVE-2026-55081

DHIS2 is a flexible information system for data capture, management, validation, analytics and visualization. The DHIS2 OpenAPI HTML endpoint reflected values from the scope query parameter into the generated HTML document without sufficient sanitization. A crafted scope value could be rendered a...

CVE-2026-55082

Summary: CVE-2026-55082 affects DHIS2 SQL View filters. An authenticated user who has SQL View access could supply crafted filter values that are interpolated into generated SQL, allowing manipulation of SQL generated for SQL View filters and potentially accessing data outside the intended SQL Vi...

CVE-2026-55084

DHIS2 has a SQL injection vulnerability in the SqlView filter parameter of the /api/sqlViews/{viewId}/data.json endpoint. An authenticated SqlView user can inject arbitrary SQL through the filter, with output reflected in an error message, enabling error-based SQL extraction of database content. ...

CVE-2021-41187

DHIS 2 is an information system for data capture, management, validation, analytics and visualization. A SQL injection security vulnerability has been found in specific versions of DHIS2. This vulnerability affects the API endpoints for /api/trackedEntityInstances and api/events in DHIS2. The...

EUVD-2021-19500

Malware in sbrugna...

EUVD-2021-25573

Malware in sbrugna...

EUVD-2023-35459

Malicious code in bioql PyPI...

EUVD-2022-45059

Malicious code in bioql PyPI...

EUVD-2023-36345

Malicious code in bioql PyPI...

EUVD-2022-29629

Malicious code in bioql PyPI...

EUVD-2023-35458

Malicious code in bioql PyPI...

EUVD-2021-28285

Malicious code in bioql PyPI...

CVE-2023-31138

DHIS2 Core contains the service layer and Web API for DHIS2, an information system for data capture. Starting in the 2.36 branch and prior to versions 2.37.9.1, 2.38.3.1, and 2.39.1.2, using object model traversal in the payload of a PATCH request, authenticated users with write access to an obje...

CVE-2023-31139

DHIS2 Core contains the service layer and Web API for DHIS2, an information system for data capture. Starting in the 2.37 branch and prior to versions 2.37.9.1, 2.38.3.1, and 2.39.1.2, Personal Access Tokens PATs generate unrestricted session cookies. This may lead to a bypass of other access...

CVE-2023-32060

DHIS2 Core contains the service layer and Web API for DHIS2, an information system for data capture. Starting in the 2.35 branch and prior to versions 2.36.13, 2.37.8, 2.38.2, and 2.39.0, when the Category Option Combination Sharing settings are configured to control access to specific tracker...

CVE-2022-41948

DHIS 2 is an open source information system for data capture, management, validation, analytics and visualization. Affected versions are subject to a privilege escalation vulnerability. A DHIS2 user with authority to manage users can assign superuser privileges to themself by manually crafting an...

CVE-2022-41949

DHIS 2 is an open source information system for data capture, management, validation, analytics and visualization. In affected versions an authenticated DHIS2 user can craft a request to DHIS2 to instruct the server to make requests to external resources like third party servers. This could allow...

CVE-2021-32704

DHIS 2 is an information system for data capture, management, validation, analytics and visualization. A SQL injection security vulnerability has been found in specific versions of DHIS2. This vulnerability affects the /api/trackedEntityInstances API endpoint in DHIS2 versions 2.34.4, 2.35.2,...