Skip to content

Vendor

opendcim vulnerabilities

4 published CVES affecting opendcim, from public sources (CVE.org, NVD, CISA KEV, FIRST EPSS, OSV).

Total
4
Critical
3
High
0
Medium
1
Low
0
Unscored
0
CISA KEV
0
Atom feed of opendcim alerts

Products

Latest opendcim CVEs

Newest publication first

  1. CVE-2026-28517 openDCIM <= 23.04 OS Command Injection via dot Configuration Parameter

    Published
    CriticalCVSS 9.3 EPSS 6.3% Framework module

    openDCIM version 23.04, through commit 4467e9c4, contains an OS command injection vulnerability in report_network_map.php. The application retrieves the 'dot' configuration parameter from the database and passes it directly to exec() without validation or sanitization. If an atta...

  2. CVE-2026-28516 openDCIM <= 23.04 SQL Injection in Config::UpdateParameter

    Published
    CriticalCVSS 9.3 EPSS 1.1% Framework module

    openDCIM version 23.04, through commit 4467e9c4, contains a SQL injection vulnerability in Config::UpdateParameter. The install.php and container-install.php handlers pass user-supplied input directly into SQL statements using string interpolation without prepared statements or p...

  3. CVE-2026-28515 openDCIM <= 23.04 Missing Authorization in install.php

    Published
    CriticalCVSS 9.3 EPSS 1.3% Framework module

    openDCIM version 23.04, through commit 4467e9c4, contains a missing authorization vulnerability in install.php and container-install.php. The installer and upgrade handler expose LDAP configuration functionality without enforcing application role checks. Any authenticated user ca...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.