Vulnerabilities

TI-2026-22779 CVE-2026-28517 · GHSA-428h-8xhf-g3cw

openDCIM <= 23.04 OS Command Injection via dot Configuration Parameter

HIGH 81

openDCIM version 23.04, through commit 4467e9c4, contains an OS command injection vulnerability in report_network_map.php.

CVSS 4.0CRITICAL 9.3 Network No auth No interaction EPSS 0.06271 Published 2026-02-27 No fix listed CWE-78

TI-2026-22778 CVE-2026-28516 · GHSA-prmh-rp39-qc4m

HIGH 81

openDCIM version 23.04, through commit 4467e9c4, contains a SQL injection vulnerability in Config::UpdateParameter.

CVSS 4.0CRITICAL 9.3 Network No auth No interaction EPSS 0.0107 Published 2026-02-27 No fix listed CWE-89

TI-2026-22777 CVE-2026-28515 · GHSA-mg2w-x76x-59h8

HIGH 81

openDCIM version 23.04, through commit 4467e9c4, contains a missing authorization vulnerability in install.php and container-install.php.

CVSS 4.0CRITICAL 9.3 Network No auth No interaction EPSS 0.01276 Published 2026-02-27 No fix listed CWE-862

TI-2025-30934 CVE-2025-48701 · GHSA-g2x5-hh22-qjw5

LOW 24

openDCIM through 23.04 allows SQL injection in people_depts.php because prepared statements are not used.

CVSS 3.1MEDIUM 5.4 Network Low privileges No interaction EPSS 0.00242 Published 2025-05-23 No fix listed CWE-89