https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2023-32060.htmlhttps://patchthecve.com/cve/CVE-2023-32060.htmlWed, 17 Jun 2026 05:57:59 +0000MEDIUM 6.5: DHIS2 Core contains the service layer and Web API for DHIS2, an information system for data capture. Starting in the 2.35 branch and prior to versions 2.36.13, 2.37.8, 2.38.2, and 2.39.0, when the Category Option Combination Sharing settings are configured to control access to specific tracker progrhttps://patchthecve.com/cve/CVE-2023-31139.htmlhttps://patchthecve.com/cve/CVE-2023-31139.htmlWed, 17 Jun 2026 05:56:21 +0000MEDIUM 4.3: DHIS2 Core contains the service layer and Web API for DHIS2, an information system for data capture. Starting in the 2.37 branch and prior to versions 2.37.9.1, 2.38.3.1, and 2.39.1.2, Personal Access Tokens (PATs) generate unrestricted session cookies. This may lead to a bypass of other access resthttps://patchthecve.com/cve/CVE-2023-31138.htmlhttps://patchthecve.com/cve/CVE-2023-31138.htmlWed, 17 Jun 2026 05:56:21 +0000HIGH 7.1: DHIS2 Core contains the service layer and Web API for DHIS2, an information system for data capture. Starting in the 2.36 branch and prior to versions 2.37.9.1, 2.38.3.1, and 2.39.1.2, using object model traversal in the payload of a PATCH request, authenticated users with write access to an object https://patchthecve.com/cve/CVE-2022-41948.htmlhttps://patchthecve.com/cve/CVE-2022-41948.htmlWed, 17 Jun 2026 05:04:07 +0000MEDIUM 6.7: DHIS 2 is an open source information system for data capture, management, validation, analytics and visualization. Affected versions are subject to a privilege escalation vulnerability. A DHIS2 user with authority to manage users can assign superuser privileges to themself by manually crafting an HThttps://patchthecve.com/cve/CVE-2022-41947.htmlhttps://patchthecve.com/cve/CVE-2022-41947.htmlWed, 17 Jun 2026 05:04:07 +0000MEDIUM 5.4: DHIS 2 is an open source information system for data capture, management, validation, analytics and visualization. Through various features of DHIS2, an authenticated user may be able to upload a file which includes embedded javascript. The user could then potentially trick another authenticated usehttps://patchthecve.com/cve/CVE-2022-41949.htmlhttps://patchthecve.com/cve/CVE-2022-41949.htmlWed, 17 Jun 2026 05:04:07 +0000MEDIUM 5.0: DHIS 2 is an open source information system for data capture, management, validation, analytics and visualization. In affected versions an authenticated DHIS2 user can craft a request to DHIS2 to instruct the server to make requests to external resources (like third party servers). This could allow https://patchthecve.com/cve/CVE-2022-24848.htmlhttps://patchthecve.com/cve/CVE-2022-24848.htmlWed, 17 Jun 2026 04:32:39 +0000HIGH 8.8: DHIS2 is an information system for data capture, management, validation, analytics and visualization. A SQL injection security vulnerability affects the `/api/programs/orgUnits?programs=` API endpoint in DHIS2 versions prior to 2.36.10.1 and 2.37.6.1. The system is vulnerable to attack only from use