SQL Injection in Dotcms Core

CVE-2026-8054

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in the Publish Audit API endpoints (/api/auditPublishing/get and /api/auditPublishing/getAll) in dotCMS Core 25.11.04-1 through 26.04.28-02 allows remote…

Vulnerability class: SQL Injection

EPSS: 0.005 (64.3th percentile) — read the EPSS interpretation.