Dotcms vulnerabilities

Products

• Dotcms 58
• Core 6

Newest

• dotcms Improper authorization in the ToolGroupResource and RoleAjax REST/DWR endpoints in dotCMS dotCMS... CVE-2026-16337 9.4 CriticalJuly 20, 2026
• dotcms core Unauthenticated SQL Injection in dotCMS Publish Audit API CVE-2026-8054 Public exploit 10.0 CriticalMay 27, 2026
• dotcms A sandbox escape vulnerability exists in dotCMS’s Velocity scripting engine (VTools) that allows... CVE-2025-11165 9.4 CriticalFebruary 24, 2026
• dotcms cloud services (dcs) dotCMS versions 24.03.22 and after, identified a Boolean-based blind SQLi vulnerability in the ... CVE-2025-8311 Public exploit 9.4 CriticalSeptember 4, 2025
• dotcms core In the System → Maintenance tool, the Logged Users tab surfaces sessionId data for all users via... CVE-2024-4447 9.9 CriticalJuly 26, 2024
• dotcms core, dotcms +1 more The "reset password" login page accepted an HTML injection via URL parameters. This has already... CVE-2024-3938 5.4 MediumJuly 25, 2024
• dotcms, dotcms core +1 more Database Credential Exposure in the Logs CVE-2024-3165 4.5 MediumApril 1, 2024
• dotcms, dotcms core +1 more In dotCMS dashboard, the Tools and Log Files tabs under System → Maintenance Portlet, which is... CVE-2024-3164 4.5 MediumApril 1, 2024
• dotcms, dotcms core +1 more CNA SHORTNAME: dotCMSORG UUID: 5b9d93f2-25c7-46b4-ab60-d201718c9dd8 CVE-2023-3042 5.3 MediumOctober 17, 2023
• dotcms An issue was discovered in dotCMS core 4.x through 22.10.2. An authenticated directory traversal... CVE-2022-45783 6.5 MediumFebruary 1, 2023
• dotcms An issue was discovered in dotCMS core 5.3.8.5 through 5.3.8.15 and 21.03 through 22.10.1. A... CVE-2022-45782 Public exploit 8.8 HighFebruary 1, 2023
• dotcms In dotCMS 5.x-22.06, it is possible to call the TempResource multiple times, each time requesting... CVE-2022-37034 5.3 MediumFebruary 1, 2023
• dotcms In dotCMS 5.x-22.06, TempFileAPI allows a user to create a temporary file based on a passed in... CVE-2022-37033 6.5 MediumFebruary 1, 2023
• dotcms dotCMS before 22.06 allows remote attackers to bypass intended access control and obtain... CVE-2022-35740 6.1 MediumNovember 10, 2022
• dotcms A Reflected Cross-site scripting (XSS) issue was discovered in dotCMS Core through 22.06. This... CVE-2022-37431 Disputed 6.1 MediumAugust 5, 2022
• dotcms An issue was discovered in the ContentResource API in dotCMS 3.0 through 22.02. Attackers can... CVE-2022-26352 In KEVPublic exploit EPSS 91.2% 9.8 CriticalJuly 17, 2022
• dotcms Unrestricted Upload of File with Dangerous Type in DotCMS v5.2.3 and earlier allow remote... CVE-2020-19138 9.8 CriticalSeptember 8, 2021
• dotcms Incorrect Access Control in DotCMS versions before 5.1 allows remote attackers to gain privileges... CVE-2020-18875 8.8 HighAugust 18, 2021
• dotcms A stored cross site scripting (XSS) vulnerability in dotAdmin/#/c/c_Images of dotCMS 21.05.1... CVE-2021-35358 4.8 MediumJuly 9, 2021
• dotcms A reflected cross site scripting (XSS) vulnerability in dotAdmin/#/c/links of dotCMS 21.05.1... CVE-2021-35361 4.8 MediumJuly 9, 2021
• dotcms A reflected cross site scripting (XSS) vulnerability in dotAdmin/#/c/containers of dotCMS 21.05.1... CVE-2021-35360 4.8 MediumJuly 9, 2021
• dotcms Cross Site Scripting (XSS) in dotCMS v5.1.5 allows remote attackers to execute arbitrary code by... CVE-2020-17542 5.4 MediumApril 23, 2021
• dotcms dotCMS before 20.10.1 allows SQL injection, as demonstrated by the /api/v1/containers orderby... CVE-2020-27848 8.8 HighDecember 30, 2020
• dotcms DotCMS Add Template with admin panel 20.11 is affected by cross-site Scripting (XSS) to gain... CVE-2020-35274 4.8 MediumDecember 21, 2020
• dotcms dotCMS before 5.2.4 is vulnerable to directory traversal, leading to incorrect access control. It... CVE-2020-6754 EPSS 94.8% 9.8 CriticalFebruary 5, 2020
• dotcms dotCMS before 5.1.6 is vulnerable to a SQL injection that can be exploited by an attacker of the... CVE-2019-12872 7.2 HighJune 18, 2019
• dotcms dotCMS before 5.1.0 has a path traversal vulnerability exploitable by an administrator to create... CVE-2019-12309 4.9 MediumMay 23, 2019
• dotcms /servlets/ajax_file_upload?fieldName=binary3 in dotCMS 5.1.1 allows XSS and HTML Injection. CVE-2019-11846 6.1 MediumMay 14, 2019
• dotcms dotCMS before 5.0.2 has open redirects via the html/common/forward_js.jsp FORWARD_URL parameter... CVE-2018-17422 6.1 MediumMarch 7, 2019
• dotcms An issue was discovered in Dotcms through 5.0.3. Attackers may perform XSS attacks via the inode,... CVE-2018-19554 5.4 MediumNovember 26, 2018
• dotcms dotCMS V5.0.1 has XSS in the /html/portlet/ext/contentlet/image_tools/index.jsp fieldName and... CVE-2018-16980 Fix available 6.1 MediumSeptember 12, 2018
• doccms administration panel, dotcms +1 more The dotCMS administration panel, versions 3.7.1 and earlier, "Push Publishing" feature in Enterprise Pro is vulnerable to arbitrary file upload CVE-2017-3189 8.1 HighJuly 24, 2018
• doccms administration panel, dotcms +1 more The dotCMS administration panel, versions 3.7.1 and earlier, "Push Publishing" feature in Enterprise Pro is vulnerable to path traversal CVE-2017-3188 6.5 MediumJuly 24, 2018
• doccms administration panel, dotcms +1 more The dotCMS administration panel, versions 3.7.1 and earlier, are vulnerable to cross-site request forgery CVE-2017-3187 8.8 HighJuly 24, 2018
• dotcms SQL injection vulnerability in the "Content Types > Content Types" screen in dotCMS before 3.7.2... CVE-2016-10008 7.2 HighFebruary 19, 2018
• dotcms SQL injection vulnerability in the "Marketing > Forms" screen in dotCMS before 3.7.2 and 4.x... CVE-2016-10007 7.2 HighFebruary 19, 2018
• dotcms The dotCMS 4.1.1 application is vulnerable to Stored Cross-Site Scripting (XSS) affecting a... CVE-2017-15219 5.4 MediumOctober 10, 2017
• dotcms Arbitrary file upload vulnerability in com/dotmarketing/servlets/AjaxFileUploadServlet.class in... CVE-2017-11466 7.2 HighJuly 20, 2017
• dotcms dotCMS 3.7.0 has XSS reachable from ext/languages_manager/edit_language in portal/layout via the... CVE-2017-6003 6.1 MediumMarch 27, 2017
• dotcms An issue was discovered in dotCMS through 3.6.1. The findChildrenByFilter() function which is... CVE-2017-5344 Public exploit 9.8 CriticalFebruary 17, 2017
• dotcms XSS was discovered in dotCMS 3.7.0, with an unauthenticated attack against the /about-us... CVE-2017-5877 6.1 MediumFebruary 6, 2017
• dotcms XSS was discovered in dotCMS 3.7.0, with an unauthenticated attack against the /news-events... CVE-2017-5876 6.1 MediumFebruary 6, 2017
• dotcms XSS was discovered in dotCMS 3.7.0, with an authenticated attack against the /myAccount addressID... CVE-2017-5875 5.4 MediumFebruary 6, 2017
• dotcms SQL injection vulnerability in the REST API in dotCMS before 3.3.2 allows remote attackers to... CVE-2016-2355 9.8 CriticalDecember 19, 2016
• dotcms SQL injection vulnerability in the "Site Browser > HTML pages" screen in dotCMS before 3.3.1... CVE-2016-8908 8.8 HighNovember 14, 2016
• dotcms SQL injection vulnerability in the "Content Types > Content Types" screen in dotCMS before 3.3.1... CVE-2016-8907 8.8 HighNovember 14, 2016
• dotcms SQL injection vulnerability in the "Site Browser > Links pages" screen in dotCMS before 3.3.1... CVE-2016-8906 8.8 HighNovember 14, 2016
• dotcms SQL injection vulnerability in the JSONTags servlet in dotCMS before 3.3.1 allows remote... CVE-2016-8905 8.8 HighNovember 14, 2016
• dotcms SQL injection vulnerability in the "Site Browser > Containers pages" screen in dotCMS before 3.3... CVE-2016-8904 8.8 HighNovember 14, 2016
• dotcms SQL injection vulnerability in the "Site Browser > Templates pages" screen in dotCMS before 3.3.1... CVE-2016-8903 8.8 HighNovember 14, 2016
• Show olderLoading…