DO
Product
dotCMS
On CISA KEVExploited in the wildRansomware-linked
58
CVEs
1
On KEV
9.9
Max CVSS
0
New 30D
Severity mix
Critical 8High 18Medium 27Low 1
Watch
Add dotCMS to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2022-45782 | 8.8 | Feb 1 | An issue was discovered in dotCMS core 5.3.8.5 through 5.3.8.15 and 21.03 through 22.10.1 Affected: 5.3.8.5 through 5.3.8.15; 21.03 through 21.10.1 |
| CVE-2020-18875 | 8.8 | Aug 18 | Incorrect Access Control in DotCMS versions before 5.1 allows remote attackers to gain privileges by injecting client configurations via vtl (velocity) files Affected: before 5.1.0 |
| CVE-2020-27848 | 8.8 | Dec 30 | dotCMS before 20.10.1 allows SQL injection, as demonstrated by the /api/v1/containers orderby parameter Affected: before 20.10.1 |
| CVE-2017-3187 | 8.8 | Jul 24 | The dotCMS administration panel, versions 3.7.1 and earlier, are vulnerable to cross-site request forgery Affected: through 3.7.1 |
| CVE-2016-8908 | 8.8 | Nov 14 | SQL injection vulnerability in the "Site Browser > HTML pages" screen in dotCMS before 3.3.1 allows remote authenticated attackers to execute arbitrary SQL commands via the… Affected: through 3.3 |
| CVE-2016-8907 | 8.8 | Nov 14 | SQL injection vulnerability in the "Content Types > Content Types" screen in dotCMS before 3.3.1 allows remote authenticated attackers to execute arbitrary SQL commands via the… Affected: through 3.3 |
| CVE-2016-8906 | 8.8 | Nov 14 | SQL injection vulnerability in the "Site Browser > Links pages" screen in dotCMS before 3.3.1 allows remote authenticated attackers to execute arbitrary SQL commands via the… Affected: through 3.3 |
| CVE-2016-8905 | 8.8 | Nov 14 | SQL injection vulnerability in the JSONTags servlet in dotCMS before 3.3.1 allows remote authenticated attackers to execute arbitrary SQL commands via the sort parameter Affected: through 3.3 |
| CVE-2016-8904 | 8.8 | Nov 14 | SQL injection vulnerability in the "Site Browser > Containers pages" screen in dotCMS before 3.3.1 allows remote authenticated attackers to execute arbitrary SQL commands via the… Affected: through 3.3 |
| CVE-2016-8903 | 8.8 | Nov 14 | SQL injection vulnerability in the "Site Browser > Templates pages" screen in dotCMS before 3.3.1 allows remote authenticated attackers to execute arbitrary SQL commands via the… Affected: through 3.3 |
| CVE-2017-3189 | 8.1 | Jul 24 | The dotCMS administration panel, versions 3.7.1 and earlier, "Push Publishing" feature in Enterprise Pro is vulnerable to arbitrary file upload Affected: through 3.7.1 |
| CVE-2016-8600 | 7.5 | Oct 28 | In dotCMS 3.2.1, attacker can load captcha once, fill it with correct value and then this correct value is ok for forms with captcha check later Affected: 3.2.1 |
| CVE-2016-4803 | 7.5 | Jun 30 | CRLF injection vulnerability in the send email functionality in dotCMS before 3.3.2 allows remote attackers to inject arbitrary email headers via CRLF sequences in the subject Affected: through 3.3.1 |
| CVE-2019-12872 | 7.2 | Jun 18 | dotCMS before 5.1.6 is vulnerable to a SQL injection that can be exploited by an attacker of the role Publisher via view_unpushed_bundles.jsp Affected: before 5.1.6 |
| CVE-2016-10008 | 7.2 | Feb 19 | SQL injection vulnerability in the "Content Types > Content Types" screen in dotCMS before 3.7.2 and 4.x before 4.1.1 allows remote authenticated administrators to execute… Affected: before 3.7.2; 4.0.0 before 4.1.1 |
| CVE-2016-10007 | 7.2 | Feb 19 | SQL injection vulnerability in the "Marketing > Forms" screen in dotCMS before 3.7.2 and 4.x before 4.1.1 allows remote authenticated administrators to execute arbitrary SQL… Affected: before 3.7.2; 4.0.0 before 4.1.1 |
| CVE-2017-11466 | 7.2 | Jul 20 | Arbitrary file upload vulnerability in com/dotmarketing/servlets/AjaxFileUploadServlet.class in dotCMS 4.1.1 allows remote authenticated administrators to upload .jsp files to… Affected: 4.1.1 |
| CVE-2016-4040 | 7.2 | Apr 19 | SQL injection vulnerability in the Workflow Screen in dotCMS before 3.3.2 allows remote administrators to execute arbitrary SQL commands via the orderby parameter Affected: through 3.3.1 |
Showing 18