CVE-2026-16337 | | | 2026-07-20 | Improper authorization in the ToolGroupResource and RoleAjax REST/DWR endpoints in dotCMS dotCMS 21.02 through 26.06.22-03 on all platforms allows a low-privil… |
CVE-2026-8054 | | | 2026-05-27 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in the Publish Audit API endpoints (/api/auditPublishing/get and /api/audi… |
CVE-2025-11165 | Critical | 9.9 | 2026-02-24 | A sandbox escape vulnerability exists in dotCMS’s Velocity scripting engine (VTools) that allows authenticated users with scripting privileges to bypass class… |
CVE-2025-8311 | | | 2025-09-04 | dotCMS versions 24.03.22 and after, identified a Boolean-based blind SQLi vulnerability in the /api/v1/contenttype endpoint. This endpoint uses the sites query… |
CVE-2024-4447 | Critical | 9.9 | 2024-07-26 | In the System → Maintenance tool, the Logged Users tab surfaces sessionId data for all users via the Direct Web Remoting API (UserSessionAjax.getSessionList.dw… |
CVE-2024-3938 | Medium | 5.4 | 2024-07-25 | The "reset password" login page accepted an HTML injection via URL parameters.
This has already been rectified via patch, and as such it cannot be demonstrate… |
CVE-2024-3165 | Medium | 4.5 | 2024-04-01 | System->Maintenance-> Log Files in dotCMS dashboard is providing the username/password for database connections in the log output. Nevertheless, this is a mode… |
CVE-2024-3164 | Medium | 4.5 | 2024-04-01 | In dotCMS dashboard, the Tools and Log Files tabs under System → Maintenance Portlet, which is and always has been an Admin portlet, is accessible to anyone wi… |
CVE-2023-3042 | Medium | 5.3 | 2023-10-17 | In dotCMS, versions mentioned, a flaw in the NormalizationFilter does not strip double slashes (//) from URLs, potentially enabling bypasses for XSS and access… |
CVE-2022-37034 | Medium | 5.3 | 2023-02-01 | In dotCMS 5.x-22.06, it is possible to call the TempResource multiple times, each time requesting the dotCMS server to download a large file. If done repeatedl… |
CVE-2022-45783 | Medium | 6.5 | 2023-02-01 | An issue was discovered in dotCMS core 4.x through 22.10.2. An authenticated directory traversal vulnerability in the dotCMS API can lead to Remote Code Execut… |
CVE-2022-45782 | High | 8.8 | 2023-02-01 | An issue was discovered in dotCMS core 5.3.8.5 through 5.3.8.15 and 21.03 through 22.10.1. A cryptographically insecure random generation algorithm for passwor… |
CVE-2022-37033 | Medium | 6.5 | 2023-02-01 | In dotCMS 5.x-22.06, TempFileAPI allows a user to create a temporary file based on a passed in URL, while attempting to block any SSRF access to local IP addre… |
CVE-2022-35740 | Medium | 6.1 | 2022-11-10 | dotCMS before 22.06 allows remote attackers to bypass intended access control and obtain sensitive information by using a semicolon in a URL to introduce a mat… |
CVE-2022-37431 | Medium | 6.1 | 2022-08-05 | A Reflected Cross-site scripting (XSS) issue was discovered in dotCMS Core through 22.06. This occurs in the admin portal when the configuration has XSS_PROTEC… |
CVE-2022-26352 | Critical | 9.8 | 2022-07-17 | An issue was discovered in the ContentResource API in dotCMS 3.0 through 22.02. Attackers can craft a multipart form request to post a file whose filename is n… |
CVE-2020-19138 | Critical | 9.8 | 2021-09-08 | Unrestricted Upload of File with Dangerous Type in DotCMS v5.2.3 and earlier allow remote attackers to execute arbitrary code via the component "/src/main/java… |
CVE-2020-18875 | High | 8.8 | 2021-08-18 | Incorrect Access Control in DotCMS versions before 5.1 allows remote attackers to gain privileges by injecting client configurations via vtl (velocity) files. |
CVE-2021-35361 | Medium | 4.8 | 2021-07-09 | A reflected cross site scripting (XSS) vulnerability in dotAdmin/#/c/links of dotCMS 21.05.1 allows attackers to execute arbitrary commands or HTML via a craft… |
CVE-2021-35360 | Medium | 4.8 | 2021-07-09 | A reflected cross site scripting (XSS) vulnerability in dotAdmin/#/c/containers of dotCMS 21.05.1 allows attackers to execute arbitrary commands or HTML via a… |
CVE-2021-35358 | Medium | 4.8 | 2021-07-09 | A stored cross site scripting (XSS) vulnerability in dotAdmin/#/c/c_Images of dotCMS 21.05.1 allows authenticated attackers to execute arbitrary web scripts or… |
CVE-2020-17542 | Medium | 5.4 | 2021-04-23 | Cross Site Scripting (XSS) in dotCMS v5.1.5 allows remote attackers to execute arbitrary code by injecting a malicious payload into the "Task Detail" comment w… |
CVE-2020-27848 | High | 8.8 | 2020-12-30 | dotCMS before 20.10.1 allows SQL injection, as demonstrated by the /api/v1/containers orderby parameter. The PaginatorOrdered classes that are used to paginate… |
CVE-2020-35274 | Medium | 4.8 | 2020-12-21 | DotCMS Add Template with admin panel 20.11 is affected by cross-site Scripting (XSS) to gain remote privileges. An attacker could compromise the security of a… |
CVE-2020-6754 | Critical | 9.8 | 2020-02-05 | dotCMS before 5.2.4 is vulnerable to directory traversal, leading to incorrect access control. It allows an attacker to read or execute files under $TOMCAT_HOM… |
CVE-2019-12872 | High | 7.2 | 2019-06-18 | dotCMS before 5.1.6 is vulnerable to a SQL injection that can be exploited by an attacker of the role Publisher via view_unpushed_bundles.jsp. |
CVE-2019-12309 | Medium | 4.9 | 2019-05-23 | dotCMS before 5.1.0 has a path traversal vulnerability exploitable by an administrator to create files. The vulnerability is caused by the insecure extraction… |
CVE-2019-11846 | Medium | 6.1 | 2019-05-14 | /servlets/ajax_file_upload?fieldName=binary3 in dotCMS 5.1.1 allows XSS and HTML Injection. |
CVE-2018-17422 | Medium | 6.1 | 2019-03-07 | dotCMS before 5.0.2 has open redirects via the html/common/forward_js.jsp FORWARD_URL parameter or the html/portlet/ext/common/page_preview_popup.jsp hostname… |
CVE-2018-19554 | Medium | 5.4 | 2018-11-26 | An issue was discovered in Dotcms through 5.0.3. Attackers may perform XSS attacks via the inode, identifier, or fieldName parameter in html/js/dotcms/dijit/im… |
CVE-2018-16980 | Medium | 6.1 | 2018-09-12 | dotCMS V5.0.1 has XSS in the /html/portlet/ext/contentlet/image_tools/index.jsp fieldName and inode parameters. |
CVE-2017-3189 | High | 8.1 | 2018-07-24 | The dotCMS administration panel, versions 3.7.1 and earlier, "Push Publishing" feature in Enterprise Pro is vulnerable to arbitrary file upload. When "Bundle"… |
CVE-2017-3188 | Medium | 6.5 | 2018-07-24 | The dotCMS administration panel, versions 3.7.1 and earlier, "Push Publishing" feature in Enterprise Pro is vulnerable to path traversal. When "Bundle" tar.gz… |
CVE-2017-3187 | High | 8.8 | 2018-07-24 | The dotCMS administration panel, versions 3.7.1 and earlier, are vulnerable to cross-site request forgery. The dotCMS administrator panel contains a cross-site… |
CVE-2016-10008 | High | 7.2 | 2018-02-19 | SQL injection vulnerability in the "Content Types > Content Types" screen in dotCMS before 3.7.2 and 4.x before 4.1.1 allows remote authenticated administrator… |
CVE-2016-10007 | High | 7.2 | 2018-02-19 | SQL injection vulnerability in the "Marketing > Forms" screen in dotCMS before 3.7.2 and 4.x before 4.1.1 allows remote authenticated administrators to execute… |
CVE-2017-15219 | Medium | 5.4 | 2017-10-10 | The dotCMS 4.1.1 application is vulnerable to Stored Cross-Site Scripting (XSS) affecting a vanity-urls Title field, a containers Description field, and a temp… |
CVE-2017-11466 | High | 7.2 | 2017-07-20 | Arbitrary file upload vulnerability in com/dotmarketing/servlets/AjaxFileUploadServlet.class in dotCMS 4.1.1 allows remote authenticated administrators to uplo… |
CVE-2017-6003 | Medium | 6.1 | 2017-03-27 | dotCMS 3.7.0 has XSS reachable from ext/languages_manager/edit_language in portal/layout via the bottom two form fields. |
CVE-2017-5344 | Critical | 9.8 | 2017-02-17 | An issue was discovered in dotCMS through 3.6.1. The findChildrenByFilter() function which is called by the web accessible path /categoriesServlet performs str… |
CVE-2017-5877 | Medium | 6.1 | 2017-02-06 | XSS was discovered in dotCMS 3.7.0, with an unauthenticated attack against the /about-us/locations/index direction parameter. |
CVE-2017-5876 | Medium | 6.1 | 2017-02-06 | XSS was discovered in dotCMS 3.7.0, with an unauthenticated attack against the /news-events/events date parameter. |
CVE-2017-5875 | Medium | 5.4 | 2017-02-06 | XSS was discovered in dotCMS 3.7.0, with an authenticated attack against the /myAccount addressID parameter. |
CVE-2016-2355 | Critical | 9.8 | 2016-12-19 | SQL injection vulnerability in the REST API in dotCMS before 3.3.2 allows remote attackers to execute arbitrary SQL commands via the stName parameter to api/co… |
CVE-2016-8908 | High | 8.8 | 2016-11-14 | SQL injection vulnerability in the "Site Browser > HTML pages" screen in dotCMS before 3.3.1 allows remote authenticated attackers to execute arbitrary SQL com… |
CVE-2016-8907 | High | 8.8 | 2016-11-14 | SQL injection vulnerability in the "Content Types > Content Types" screen in dotCMS before 3.3.1 allows remote authenticated attackers to execute arbitrary SQL… |
CVE-2016-8906 | High | 8.8 | 2016-11-14 | SQL injection vulnerability in the "Site Browser > Links pages" screen in dotCMS before 3.3.1 allows remote authenticated attackers to execute arbitrary SQL co… |
CVE-2016-8905 | High | 8.8 | 2016-11-14 | SQL injection vulnerability in the JSONTags servlet in dotCMS before 3.3.1 allows remote authenticated attackers to execute arbitrary SQL commands via the sort… |
CVE-2016-8904 | High | 8.8 | 2016-11-14 | SQL injection vulnerability in the "Site Browser > Containers pages" screen in dotCMS before 3.3.1 allows remote authenticated attackers to execute arbitrary S… |
CVE-2016-8903 | High | 8.8 | 2016-11-14 | SQL injection vulnerability in the "Site Browser > Templates pages" screen in dotCMS before 3.3.1 allows remote authenticated attackers to execute arbitrary SQ… |
CVE-2016-8902 | Critical | 9.8 | 2016-11-14 | SQL injection vulnerability in the categoriesServlet servlet in dotCMS before 3.3.1 allows remote not authenticated attackers to execute arbitrary SQL commands… |
CVE-2016-8600 | High | 7.5 | 2016-10-28 | In dotCMS 3.2.1, attacker can load captcha once, fill it with correct value and then this correct value is ok for forms with captcha check later. |
CVE-2016-4803 | High | 7.5 | 2016-06-30 | CRLF injection vulnerability in the send email functionality in dotCMS before 3.3.2 allows remote attackers to inject arbitrary email headers via CRLF sequence… |
CVE-2016-4040 | High | 7.2 | 2016-04-19 | SQL injection vulnerability in the Workflow Screen in dotCMS before 3.3.2 allows remote administrators to execute arbitrary SQL commands via the orderby parame… |
CVE-2016-3688 | Medium | 6.5 | 2016-04-19 | SQL injection vulnerability in dotCMS before 3.5 allows remote administrators to execute arbitrary SQL commands via the c0-e3 parameter to dwr/call/plaincall/U… |
CVE-2016-3972 | Low | 2.7 | 2016-04-18 | Directory traversal vulnerability in the dotTailLogServlet in dotCMS before 3.5.1 allows remote authenticated administrators to read arbitrary files via a .. (… |
CVE-2016-3971 | Medium | 4.8 | 2016-04-18 | Cross-site scripting (XSS) vulnerability in lucene_search.jsp in dotCMS before 3.5.1 allows remote attackers to inject arbitrary web script or HTML via the que… |
CVE-2013-3484 | | | 2014-04-02 | Multiple cross-site scripting (XSS) vulnerabilities in dotCMS before 2.3.2 allow remote attackers to inject arbitrary web script or HTML via the (1) _loginUser… |
CVE-2012-1826 | | | 2012-06-08 | dotCMS 1.9 before 1.9.5.1 allows remote authenticated users to execute arbitrary Java code via a crafted (1) XSLT or (2) Velocity template. |
CVE-2008-3708 | | | 2008-08-19 | Multiple directory traversal vulnerabilities in dotCMS 1.6.0.9 allow remote attackers to read arbitrary files via a .. (dot dot) in the id parameter to (1) new… |
CVE-2008-2397 | | | 2008-05-21 | Cross-site scripting (XSS) vulnerability in search-results.dot in dotCMS 1.x allows remote attackers to inject arbitrary web script or HTML via the search_quer… |