Opendcim is a data-center infrastructure management platform with a narrow but strategically important role in managing facility assets and operations, presenting a focused vulnerability surface around its single product line. Reported issues center on application-layer security weaknesses including OS command injection, SQL injection, and missing authorization controls, reflecting common risks in web-based administrative tools that require access to sensitive infrastructure state. Current exploitation activity and exposure counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Opendcim over time
Signals from CVEs in this vendor scope (4 CVEs).
4 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2026-28517CRITICAL openDCIM version 23.04, through commit 4467e9c4, contains an OS command injection vulnerability in report_network_map.php. The application retrieves the 'dot' configuration paramet | Feb 27, 2026 | 9.8 | 53 | NO | YES |
CVE-2026-28515HIGH openDCIM version 23.04, through commit 4467e9c4, contains a missing authorization vulnerability in install.php and container-install.php. The installer and upgrade handler expose L | Feb 27, 2026 | 8.8 | 48 | NO | YES |
CVE-2026-28516HIGH openDCIM version 23.04, through commit 4467e9c4, contains a SQL injection vulnerability in Config::UpdateParameter. The install.php and container-install.php handlers pass user-sup | Feb 27, 2026 | 8.8 | 47 | NO | YES |
CVE-2025-48701MEDIUM openDCIM through 23.04 allows SQL injection in people_depts.php because prepared statements are not used. | May 23, 2025 | 5.4 | 16 | NO | NO |
Signals from CVEs in this vendor scope (4 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Opendcim.
Media articles that mention a CVE ID that affects a product developed by Opendcim — matched by CVE ID, not by vendor name.