CVE Feed

    Dashboard / CVE / CVE-2026-28516

    CVE-2026-28516

    openDCIM version 23.04, through commit 4467e9c4, contains a SQL injection vulnerability in Config::UpdateParameter. The install.php and container-install.php handlers pass user-supplied input directly into SQL statements using string interpolation without prepared statements or proper input sanitation. An authenticated user can execute arbitrary SQL statements against the underlying database.

    Published:Feb 27, 2026
    Last Modified:Jul 14, 2026
    EPS:Feb 27, 2026
    EPSS Score:0.0097
    CVSS Score:8.8

    Affected Products

    Vendor
    Opendcim
    Product
    Opendcim

    Exploits

    https://chocapikk.com/posts/2026/opendcim-sqli-to-rce/https://github.com/Chocapikk/opendcim-exploit

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High