DO
Product
dotCMS
On CISA KEVExploited in the wildRansomware-linked
58
CVEs
1
On KEV
9.9
Max CVSS
0
New 30D
Severity mix
Critical 8High 18Medium 27Low 1
Watch
Add dotCMS to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2016-3971 | 4.8 | Apr 18 | Cross-site scripting (XSS) vulnerability in lucene_search.jsp in dotCMS before 3.5.1 allows remote attackers to inject arbitrary web script or HTML via the query parameter to… Affected: through 3.5 |
| CVE-2024-3165 | 4.5 | Apr 1 | System->Maintenance-> Log Files in dotCMS dashboard is providing the username/password for database connections in the log output Affected: 22.02 before 22.03.15; 23.01 before 23.01.15; 23.02 through 23.09.7; 23.10.24; 23.10.24; 23.10.24; +4 more |
| CVE-2024-3164 | 4.5 | Apr 1 | In dotCMS dashboard, the Tools and Log Files tabs under System → Maintenance Portlet, which is and always has been an Admin portlet, is accessible to anyone with that portlet and… Affected: 22.02 before 22.03.15; 23.01 before 23.01.15; 23.02 through 23.09.7; 23.10.24; 23.10.24; 23.10.24; +4 more |
| CVE-2016-3972 | 2.7 | Apr 18 | Directory traversal vulnerability in the dotTailLogServlet in dotCMS before 3.5.1 allows remote authenticated administrators to read arbitrary files via a Affected: through 3.5 |
| CVE-2013-3484 | – | Apr 2 | Multiple cross-site scripting (XSS) vulnerabilities in dotCMS before 2.3.2 allow remote attackers to inject arbitrary web script or HTML via the (1) _loginUserName parameter to… Affected: through 2.3.1; 1.9.5.1; 2.0; 2.0.1; 2.1; 2.1.1; +3 more |
| CVE-2012-1826 | – | Jun 8 | dotCMS 1.9 before 1.9.5.1 allows remote authenticated users to execute arbitrary Java code via a crafted (1) XSLT or (2) Velocity template Affected: 1.9; 1.9.2.1 |
| CVE-2008-3708 | – | Aug 19 | Multiple directory traversal vulnerabilities in dotCMS 1.6.0.9 allow remote attackers to read arbitrary files via a Affected: 1.6.0.9 |
| CVE-2008-2397 | – | May 21 | Cross-site scripting (XSS) vulnerability in search-results.dot in dotCMS 1.x allows remote attackers to inject arbitrary web script or HTML via the search_query parameter Affected: 1.0; 1.2.0; 1.5.0; 1.5.1; 1.5.1.1; 1.6; +7 more |