Vulnerability-Lookup

VA-26-204-02

Vulnerability from csaf_cisa - Published: 2026-07-23 18:24 - Updated: 2026-07-23 18:24

Summary

DHIS2 SQL Injection in SqlView Filter Parameter Leading to Arbitrary Database Read

Notes

Legal Notice: All information products included in [https://github.com/cisagov/CSAF/tree/develop/csaf_files/IT/white](https://github.com/cisagov/CSAF/tree/develop/csaf_files/IT/white) are provided \"as is\" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. DHS does not endorse any commercial product or service, referenced in this product or otherwise. Further dissemination of this product is governed by the Traffic Light Protocol (TLP) marking in the header. For more information about TLP, see [https://us-cert.cisa.gov/tlp/](https://us-cert.cisa.gov/tlp/).

Countries and Areas Deployed: Worldwide

Critical Infrastructure Sectors: Information Technology

Risk Evaluation: A SQL injection vulnerability was identified in the SqlView API endpoint of the DHIS2 application in the `filter` parameter used by the `/api/sqlViews/{viewId}/data.json` endpoint. An authenticated user with access to a SqlView can inject arbitrary SQL queries inside the `filter` parameter by abusing an expression executed by PostgreSQL and its output is reflected inside the application error message. This behavior enables attackers to extract arbitrary database content using error-based SQL injection.

Recommended Practices: Fixed in PR #24162. Update to one of the fixed versions.

Company Headquarters Location: Norway

CVE-2026-55084

8.8 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Affected products

Known affected 5 products

Product	Identifier	Version	Remediation
dhis2 dhis2-core >=2.37\|<=2.39 dhis2 / dhis2-core		>=2.37\|<=2.39
dhis2 dhis2-core >=2.40.0\|<2.40.11.1 dhis2 / dhis2-core		>=2.40.0\|<2.40.11.1
dhis2 dhis2-core >=2.41.0\|<2.41.8.2 dhis2 / dhis2-core		>=2.41.0\|<2.41.8.2
dhis2 dhis2-core >=2.42.0\|<2.42.5.1 dhis2 / dhis2-core		>=2.42.0\|<2.42.5.1
dhis2 dhis2-core >=2.43.0\|<2.43.0.1 dhis2 / dhis2-core		>=2.43.0\|<2.43.0.1

Fixed 9 products

Product	Version	Remediation
dhis2 dhis2-core 2.37-EOS (2026-06-09) dhis2 / dhis2-core	2.37-EOS (2026-06-09)	Vendor Fix fix
dhis2 dhis2-core 2.38-EOS (2026-06-09) dhis2 / dhis2-core	2.38-EOS (2026-06-09)	Vendor Fix fix
dhis2 dhis2-core 2.39-EOS (2026-06-09) dhis2 / dhis2-core	2.39-EOS (2026-06-09)	Vendor Fix fix
dhis2 dhis2-core 2.40.11.1 dhis2 / dhis2-core	2.40.11.1	Vendor Fix fix
dhis2 dhis2-core 2.40.12 dhis2 / dhis2-core	2.40.12	Vendor Fix fix
dhis2 dhis2-core 2.41.8.2 dhis2 / dhis2-core	2.41.8.2	Vendor Fix fix
dhis2 dhis2-core 2.42.5.1 dhis2 / dhis2-core	2.42.5.1	Vendor Fix fix
dhis2 dhis2-core 2.43.0.1 dhis2 / dhis2-core	2.43.0.1	Vendor Fix fix
dhis2 dhis2-core 2.44 dhis2 / dhis2-core	2.44	Vendor Fix fix

References

5 references

URL	Category
https://raw.githubusercontent.com/cisagov/CSAF/de…	self
https://github.com/dhis2/dhis2-core/security/advi…	external
https://github.com/dhis2/dhis2-core/pull/24162	external
https://www.cve.org/CVERecord?id=CVE-2026-55084	external
https://raw.githubusercontent.com/cisagov/CSAF/de…	external

Acknowledgments

Ahmed Najeh

JSON

To clipboard

{
  "document": {
    "category": "csaf_vex",
    "csaf_version": "2.0",
    "distribution": {
      "tlp": {
        "label": "WHITE"
      }
    },
    "lang": "en-US",
    "notes": [
      {
        "category": "legal_disclaimer",
        "text": "All information products included in [https://github.com/cisagov/CSAF/tree/develop/csaf_files/IT/white](https://github.com/cisagov/CSAF/tree/develop/csaf_files/IT/white) are provided \\\"as is\\\" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. DHS does not endorse any commercial product or service, referenced in this product or otherwise. Further dissemination of this product is governed by the Traffic Light Protocol (TLP) marking in the header. For more information about TLP, see [https://us-cert.cisa.gov/tlp/](https://us-cert.cisa.gov/tlp/).",
        "title": "Legal Notice"
      },
      {
        "category": "other",
        "text": "Worldwide",
        "title": "Countries and Areas Deployed"
      },
      {
        "category": "other",
        "text": "Information Technology",
        "title": "Critical Infrastructure Sectors"
      },
      {
        "category": "summary",
        "text": "A SQL injection vulnerability was identified in the SqlView API endpoint of the DHIS2 application in the `filter` parameter used by the `/api/sqlViews/{viewId}/data.json` endpoint. An authenticated user with access to a SqlView can inject arbitrary SQL queries inside the `filter` parameter by abusing an expression executed by PostgreSQL and its output is reflected inside the application error message. This behavior enables attackers to extract arbitrary database content using error-based SQL injection.",
        "title": "Risk Evaluation"
      },
      {
        "category": "general",
        "text": "Fixed in PR #24162. Update to one of the fixed versions.",
        "title": "Recommended Practices"
      },
      {
        "category": "other",
        "text": "Norway",
        "title": "Company Headquarters Location"
      }
    ],
    "publisher": {
      "category": "coordinator",
      "contact_details": "https://www.cisa.gov/report",
      "issuing_authority": "CISA",
      "name": "CISA",
      "namespace": "https://www.cisa.gov/"
    },
    "references": [
      {
        "category": "self",
        "summary": "Vulnerability Advisory VA-26-204-02 CSAF",
        "url": "https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2026/va-26-204-02.json"
      }
    ],
    "title": "DHIS2 SQL Injection in SqlView Filter Parameter Leading to Arbitrary Database Read",
    "tracking": {
      "current_release_date": "2026-07-23T18:24:12Z",
      "generator": {
        "engine": {
          "name": "VINCE-NT",
          "version": "1.15.0+build.101"
        }
      },
      "id": "VA-26-204-02",
      "initial_release_date": "2026-07-23T18:24:12Z",
      "revision_history": [
        {
          "date": "2026-07-23T18:24:12Z",
          "number": "1.0.0",
          "summary": "Initial publication"
        }
      ],
      "status": "final",
      "version": "1.0.0"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003e=2.37|\u003c=2.39",
                "product": {
                  "name": "dhis2 dhis2-core \u003e=2.37|\u003c=2.39",
                  "product_id": "CSAFPID-0001"
                }
              },
              {
                "category": "product_version_range",
                "name": "\u003e=2.40.0|\u003c2.40.11.1",
                "product": {
                  "name": "dhis2 dhis2-core \u003e=2.40.0|\u003c2.40.11.1",
                  "product_id": "CSAFPID-0002"
                }
              },
              {
                "category": "product_version_range",
                "name": "\u003e=2.41.0|\u003c2.41.8.2",
                "product": {
                  "name": "dhis2 dhis2-core \u003e=2.41.0|\u003c2.41.8.2",
                  "product_id": "CSAFPID-0003"
                }
              },
              {
                "category": "product_version_range",
                "name": "\u003e=2.42.0|\u003c2.42.5.1",
                "product": {
                  "name": "dhis2 dhis2-core \u003e=2.42.0|\u003c2.42.5.1",
                  "product_id": "CSAFPID-0004"
                }
              },
              {
                "category": "product_version_range",
                "name": "\u003e=2.43.0|\u003c2.43.0.1",
                "product": {
                  "name": "dhis2 dhis2-core \u003e=2.43.0|\u003c2.43.0.1",
                  "product_id": "CSAFPID-0005"
                }
              },
              {
                "category": "product_version",
                "name": "2.37-EOS (2026-06-09)",
                "product": {
                  "name": "dhis2 dhis2-core 2.37-EOS (2026-06-09)",
                  "product_id": "CSAFPID-0006"
                }
              },
              {
                "category": "product_version",
                "name": "2.38-EOS (2026-06-09)",
                "product": {
                  "name": "dhis2 dhis2-core 2.38-EOS (2026-06-09)",
                  "product_id": "CSAFPID-0007"
                }
              },
              {
                "category": "product_version",
                "name": "2.39-EOS (2026-06-09)",
                "product": {
                  "name": "dhis2 dhis2-core 2.39-EOS (2026-06-09)",
                  "product_id": "CSAFPID-0008"
                }
              },
              {
                "category": "product_version",
                "name": "2.40.11.1",
                "product": {
                  "name": "dhis2 dhis2-core 2.40.11.1",
                  "product_id": "CSAFPID-0009"
                }
              },
              {
                "category": "product_version",
                "name": "2.40.12",
                "product": {
                  "name": "dhis2 dhis2-core 2.40.12",
                  "product_id": "CSAFPID-0010"
                }
              },
              {
                "category": "product_version",
                "name": "2.41.8.2",
                "product": {
                  "name": "dhis2 dhis2-core 2.41.8.2",
                  "product_id": "CSAFPID-0011"
                }
              },
              {
                "category": "product_version",
                "name": "2.42.5.1",
                "product": {
                  "name": "dhis2 dhis2-core 2.42.5.1",
                  "product_id": "CSAFPID-0012"
                }
              },
              {
                "category": "product_version",
                "name": "2.43.0.1",
                "product": {
                  "name": "dhis2 dhis2-core 2.43.0.1",
                  "product_id": "CSAFPID-0013"
                }
              },
              {
                "category": "product_version",
                "name": "2.44",
                "product": {
                  "name": "dhis2 dhis2-core 2.44",
                  "product_id": "CSAFPID-0014"
                }
              }
            ],
            "category": "product_name",
            "name": "dhis2-core"
          }
        ],
        "category": "vendor",
        "name": "dhis2"
      }
    ]
  },
  "vulnerabilities": [
    {
      "acknowledgments": [
        {
          "names": [
            "Ahmed Najeh"
          ]
        }
      ],
      "cve": "CVE-2026-55084",
      "cwe": {
        "id": "CWE-89",
        "name": "Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027)"
      },
      "notes": [
        {
          "category": "summary",
          "text": "DHIS2 is a flexible information system for data capture, management, validation, analytics and visualization. A SQL injection vulnerability was identified in the SqlView API endpoint of the DHIS2 application in the `filter` parameter used by the\n`/api/sqlViews/{viewId}/data.json` endpoint. An authenticated user with access to a SqlView can inject arbitrary SQL queries inside the `filter` parameter by abusing an expression executed by PostgreSQL and its output is reflected inside the application error message. This behavior enables attackers to extract arbitrary database content using error-based SQL injection. Fixed in PR #24162.",
          "title": "Description"
        },
        {
          "category": "details",
          "text": "SSVCv2/E:N/A:N/T:T/2026-07-22T15:52:51Z/",
          "title": "SSVC"
        }
      ],
      "product_status": {
        "fixed": [
          "CSAFPID-0006",
          "CSAFPID-0007",
          "CSAFPID-0008",
          "CSAFPID-0009",
          "CSAFPID-0010",
          "CSAFPID-0011",
          "CSAFPID-0012",
          "CSAFPID-0013",
          "CSAFPID-0014"
        ],
        "known_affected": [
          "CSAFPID-0001",
          "CSAFPID-0002",
          "CSAFPID-0003",
          "CSAFPID-0004",
          "CSAFPID-0005"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "github.com",
          "url": "https://github.com/dhis2/dhis2-core/security/advisories/GHSA-pwmg-mvjw-4m23"
        },
        {
          "category": "external",
          "summary": "github.com",
          "url": "https://github.com/dhis2/dhis2-core/pull/24162"
        },
        {
          "category": "external",
          "summary": "CVE-2026-55084",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-55084"
        },
        {
          "category": "external",
          "summary": "VA-26-204-02 CSAF",
          "url": "https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2026/va-26-204-02.json"
        }
      ],
      "release_date": "2026-07-21T00:00:00Z",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-06-09T00:00:00Z",
          "details": "Fixed in 2.37-EOS (2026-06-09).",
          "product_ids": [
            "CSAFPID-0006"
          ],
          "url": "https://github.com/dhis2/dhis2-core/pull/24162"
        },
        {
          "category": "vendor_fix",
          "date": "2026-06-09T00:00:00Z",
          "details": "Fixed in 2.38-EOS (2026-06-09).",
          "product_ids": [
            "CSAFPID-0007"
          ],
          "url": "https://github.com/dhis2/dhis2-core/pull/24162"
        },
        {
          "category": "vendor_fix",
          "date": "2026-06-09T00:00:00Z",
          "details": "Fixed in 2.39-EOS (2026-06-09).",
          "product_ids": [
            "CSAFPID-0008"
          ],
          "url": "https://github.com/dhis2/dhis2-core/pull/24162"
        },
        {
          "category": "vendor_fix",
          "date": "2026-06-09T00:00:00Z",
          "details": "Fixed in 2.40.11.1.",
          "product_ids": [
            "CSAFPID-0009"
          ],
          "url": "https://github.com/dhis2/dhis2-core/pull/24162"
        },
        {
          "category": "vendor_fix",
          "date": "2026-06-09T00:00:00Z",
          "details": "Fixed in 2.40.12.",
          "product_ids": [
            "CSAFPID-0010"
          ],
          "url": "https://github.com/dhis2/dhis2-core/pull/24162"
        },
        {
          "category": "vendor_fix",
          "date": "2026-06-09T00:00:00Z",
          "details": "Fixed in 2.41.8.2.",
          "product_ids": [
            "CSAFPID-0011"
          ],
          "url": "https://github.com/dhis2/dhis2-core/pull/24162"
        },
        {
          "category": "vendor_fix",
          "date": "2026-06-09T00:00:00Z",
          "details": "Fixed in 2.42.5.1.",
          "product_ids": [
            "CSAFPID-0012"
          ],
          "url": "https://github.com/dhis2/dhis2-core/pull/24162"
        },
        {
          "category": "vendor_fix",
          "date": "2026-06-09T00:00:00Z",
          "details": "Fixed in 2.43.0.1.",
          "product_ids": [
            "CSAFPID-0013"
          ],
          "url": "https://github.com/dhis2/dhis2-core/pull/24162"
        },
        {
          "category": "vendor_fix",
          "date": "2026-06-09T00:00:00Z",
          "details": "Fixed in 2.44.",
          "product_ids": [
            "CSAFPID-0014"
          ],
          "url": "https://github.com/dhis2/dhis2-core/pull/24162"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001",
            "CSAFPID-0002",
            "CSAFPID-0003",
            "CSAFPID-0004",
            "CSAFPID-0005"
          ]
        }
      ],
      "title": "SQL Injection in SqlView Filter Parameter Leading to Arbitrary Database Read"
    }
  ]
}

CVE-2026-55084 (GCVE-0-2026-55084)

Vulnerability from cvelistv5 – Published: 2026-07-21 18:30 – Updated: 2026-07-21 19:03

Title

SQL Injection in SqlView Filter Parameter Leading to Arbitrary Database Read

Summary

DHIS2 is a flexible information system for data capture, management, validation, analytics and visualization. A SQL injection vulnerability was identified in the SqlView API endpoint of the DHIS2 application in the `filter` parameter used by the `/api/sqlViews/{viewId}/data.json` endpoint. An authenticated user with access to a SqlView can inject arbitrary SQL queries inside the `filter` parameter by abusing an expression executed by PostgreSQL and its output is reflected inside the application error message. This behavior enables attackers to extract arbitrary database content using error-based SQL injection. Affected versions include: 2.37, 2.38, 2.39, 2.40.x before 2.40.11.1/2.40.12, 2.41.x before 2.41.8.2, 2.42.x before 2.42.5.1, 2.43.0 before 2.43.0.1, 2.44 development branch before PR #24162 Patched versions include: 2.37-EOS (2026-06-09), 2.38-EOS (2026-06-09), 2.39-EOS (2026-06-09), 2.40.11.1, 2.40.12, 2.41.8.2, 2.42.5.1, 2.43.0.1, 2.44 development branch after PR #24162

Severity

8.8 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-07-21 19:03 UTC

CWE

CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Assigner

GitHub_M mitre root Scorecard

References

2 references

URL	Tags
https://github.com/dhis2/dhis2-core/security/advi…	x_refsource_CONFIRM
https://github.com/dhis2/dhis2-core/pull/24162	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
dhis2	dhis2-core	Affected: >= 2.37, <= 2.39 Affected: >= 2.40.0, < 2.40.11.1 Affected: >= 2.41.0, < 2.41.8.2 Affected: >= 2.42.0, < 2.42.5.1 Affected: >= 2.43.0, < 2.43.0.1

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-55084",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-21T19:03:51.495263Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-21T19:03:58.016Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "dhis2-core",
          "vendor": "dhis2",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 2.37, \u003c= 2.39"
            },
            {
              "status": "affected",
              "version": "\u003e= 2.40.0, \u003c 2.40.11.1"
            },
            {
              "status": "affected",
              "version": "\u003e= 2.41.0, \u003c 2.41.8.2"
            },
            {
              "status": "affected",
              "version": "\u003e= 2.42.0, \u003c 2.42.5.1"
            },
            {
              "status": "affected",
              "version": "\u003e= 2.43.0, \u003c 2.43.0.1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "DHIS2 is a flexible information system for data capture, management, validation, analytics and visualization. A SQL injection vulnerability was identified in the SqlView API endpoint of the DHIS2 application in the `filter` parameter used by the\n`/api/sqlViews/{viewId}/data.json` endpoint. An authenticated user with access to a SqlView can inject arbitrary SQL queries inside the `filter` parameter by abusing an expression executed by PostgreSQL and its output is reflected inside the application error message. This behavior enables attackers to extract arbitrary database content using error-based SQL injection.\n\nAffected versions include: 2.37, 2.38, 2.39, 2.40.x before 2.40.11.1/2.40.12, 2.41.x before 2.41.8.2, 2.42.x before 2.42.5.1, 2.43.0 before 2.43.0.1, 2.44 development branch before PR #24162\nPatched versions include: 2.37-EOS (2026-06-09), 2.38-EOS (2026-06-09), 2.39-EOS (2026-06-09), 2.40.11.1, 2.40.12, 2.41.8.2, 2.42.5.1, 2.43.0.1, 2.44 development branch after PR #24162"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-89",
              "description": "CWE-89: Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-21T18:30:09.057Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/dhis2/dhis2-core/security/advisories/GHSA-pwmg-mvjw-4m23",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/dhis2/dhis2-core/security/advisories/GHSA-pwmg-mvjw-4m23"
        },
        {
          "name": "https://github.com/dhis2/dhis2-core/pull/24162",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/dhis2/dhis2-core/pull/24162"
        }
      ],
      "source": {
        "advisory": "GHSA-pwmg-mvjw-4m23",
        "discovery": "UNKNOWN"
      },
      "title": "SQL Injection in SqlView Filter Parameter Leading to Arbitrary Database Read"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-55084",
    "datePublished": "2026-07-21T18:30:09.057Z",
    "dateReserved": "2026-06-16T14:41:54.577Z",
    "dateUpdated": "2026-07-21T19:03:58.016Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Product	Identifier	Version	Remediation
dhis2 dhis2-core >=2.37\|<=2.39 dhis2 / dhis2-core		>=2.37\|<=2.39
dhis2 dhis2-core >=2.40.0\|<2.40.11.1 dhis2 / dhis2-core		>=2.40.0\|<2.40.11.1
dhis2 dhis2-core >=2.41.0\|<2.41.8.2 dhis2 / dhis2-core		>=2.41.0\|<2.41.8.2
dhis2 dhis2-core >=2.42.0\|<2.42.5.1 dhis2 / dhis2-core		>=2.42.0\|<2.42.5.1
dhis2 dhis2-core >=2.43.0\|<2.43.0.1 dhis2 / dhis2-core		>=2.43.0\|<2.43.0.1

Action not permitted

VA-26-204-02

CVE-2026-55084 (GCVE-0-2026-55084)

Tags

Sightings

Nomenclature

Related by attack behaviour