Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-55084— SQL Injection in SqlView Filter Parameter Leading to Arbitrary Database Read

CVSS 8.8 · High EPSS 0.25% · P17

Affected Version Matrix 5

VendorProductVersion RangeStatus
dhis2dhis2-core>= 2.37, <= 2.39affected
>= 2.40.0, < 2.40.11.1affected
>= 2.41.0, < 2.41.8.2affected
>= 2.42.0, < 2.42.5.1affected
>= 2.43.0, < 2.43.0.1affected
Get alerts for future matching vulnerabilitiesLog in to subscribe

I. Basic Information for CVE-2026-55084

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
SQL Injection in SqlView Filter Parameter Leading to Arbitrary Database Read
Source: CVE Program / CVE List V5
Vulnerability Description
DHIS2 is a flexible information system for data capture, management, validation, analytics and visualization. A SQL injection vulnerability was identified in the SqlView API endpoint of the DHIS2 application in the `filter` parameter used by the `/api/sqlViews/{viewId}/data.json` endpoint. An authenticated user with access to a SqlView can inject arbitrary SQL queries inside the `filter` parameter by abusing an expression executed by PostgreSQL and its output is reflected inside the application error message. This behavior enables attackers to extract arbitrary database content using error-based SQL injection. Affected versions include: 2.37, 2.38, 2.39, 2.40.x before 2.40.11.1/2.40.12, 2.41.x before 2.41.8.2, 2.42.x before 2.42.5.1, 2.43.0 before 2.43.0.1, 2.44 development branch before PR #24162 Patched versions include: 2.37-EOS (2026-06-09), 2.38-EOS (2026-06-09), 2.39-EOS (2026-06-09), 2.40.11.1, 2.40.12, 2.41.8.2, 2.42.5.1, 2.43.0.1, 2.44 development branch after PR #24162
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
SQL命令中使用的特殊元素转义处理不恰当(SQL注入)
Source: CVE Program / CVE List V5
Vulnerability Title
DHIS2 SQL注入漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
dhis2 dhis2-core是dhis2组织的一个应用服务器软件。 DHIS2 2.37版本、2.38版本、2.39版本、2.40.11.1版本及之前版本、2.41.8.2版本之前版本、2.42.5.1版本之前版本、2.43.0.1版本之前的2.43.0版本存在SQL注入漏洞，该漏洞源于SqlView API端点中`filter`参数存在SQL注入，可能导致具有SqlView访问权限的认证用户在参数中注入任意SQL查询，通过滥用表达式执行并利用错误消息反射输出，从而通过基于错误的SQL注入提取任意数据
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

VendorProductAffected VersionsCPESubscribe
dhis2dhis2-core >= 2.37, <= 2.39 -

II. Public POCs for CVE-2026-55084

#POC DescriptionSource LinkShenlong Link
AI-Generated POCPremium
Qwen3.6-35B-A3B · 9115 chars
Pro+ exclusive includes:
Vulnerability reproduction recording (real sandbox build + trigger, exclusive)
In-depth vulnerability mechanism
Trigger conditions & impact
Full executable POC code
Exploit chain & mitigation
POC zip download
100+ AI POC generations per month

III. Intelligence Information for CVE-2026-55084

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-55084 (1)

Vendor Advisories for CVE-2026-55084 (1)

Same Patch Batch · dhis2 · 2026-07-21 · 3 CVEs total

CVE-2026-55081DHIS2 Reflected XSS in OpenAPI HTML scope parameter
CVE-2026-55082DHIS2 SQL injection in SQL View filter values

IV. Related Vulnerabilities

Same product: dhis2-core
Same vendor: dhis2
Same weakness: CWE-89

V. Comments for CVE-2026-55084

No comments yet

Leave a comment