DO
Product
dotCMS
On CISA KEVExploited in the wildRansomware-linked
58
CVEs
1
On KEV
9.9
Max CVSS
0
New 30D
Severity mix
Critical 8High 18Medium 27Low 1
Watch
Add dotCMS to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2022-26352 RansomwareIn wildKEV | 9.8 | Jul 17 | dotCMS Unrestricted Upload of File Vulnerability Affected: 3.0 through 22.02 |
| CVE-2025-11165 | 9.9 | Feb 24 | A sandbox escape vulnerability exists in dotCMS’s Velocity scripting engine (VTools) that allows authenticated users with scripting privileges to bypass class and package… Affected: 24.12; 25.07 |
| CVE-2020-19138 | 9.8 | Sep 8 | Unrestricted Upload of File with Dangerous Type in DotCMS v5.2.3 and earlier allow remote attackers to execute arbitrary code via the component… Affected: through 5.2.3 |
| CVE-2020-6754 | 9.8 | Feb 5 | dotCMS before 5.2.4 is vulnerable to directory traversal, leading to incorrect access control Affected: before 5.2.4 |
| CVE-2017-5344 | 9.8 | Feb 17 | An issue was discovered in dotCMS through 3.6.1 Affected: through 3.6.1 |
| CVE-2016-2355 | 9.8 | Dec 19 | SQL injection vulnerability in the REST API in dotCMS before 3.3.2 allows remote attackers to execute arbitrary SQL commands via the stName parameter to api/content/save/1 Affected: through 3.3.1 |
| CVE-2016-8902 | 9.8 | Nov 14 | SQL injection vulnerability in the categoriesServlet servlet in dotCMS before 3.3.1 allows remote not authenticated attackers to execute arbitrary SQL commands via the sort… Affected: through 3.3 |
| CVE-2026-16337 | 9.4 | Jul 20 | Improper authorization in the ToolGroupResource and RoleAjax REST/DWR endpoints in dotCMS dotCMS 21.02 through 26.06.22-03 on all platforms allows a low-privileged authenticated… Affected: 21.02 through 26.06.22-03 |
Showing 8