dotCMS vulnerabilities

CVEs per yearBy the year they were published

1. 20231
2. 20244
3. 20251
4. 20263

Newest CVEs

• CVE-2026-16337

  Improper authorization in the ToolGroupResource and RoleAjax REST/DWR endpoints in dotCMS dotCMS 21.02 through 26.06.22-03 on all platforms allows a…

  dotCMS · dotCMS

  Critical9.4
• CVE-2026-8054

  Unauthenticated SQL Injection in dotCMS Publish Audit API

  dotCMS · dotCMS Core

  Critical10.0
• CVE-2025-11165

  A sandbox escape vulnerability exists in dotCMS’s Velocity scripting engine (VTools) that allows authenticated users with scripting privileges to bypass class…

  dotCMS · dotCMS

  Critical9.4
• CVE-2025-8311

  dotCMS versions 24.03.22 and after, identified a Boolean-based blind SQLi vulnerability in the /api/v1/contenttype endpoint. This endpoint uses the sites query…

  dotCMS · dotCMS Cloud Services (dCS)

  Critical9.4
• CVE-2024-4447

  In the System → Maintenance tool, the Logged Users tab surfaces sessionId data for all users via the Direct Web Remoting API…

  dotCMS · dotCMS core

  Critical9.9
• CVE-2024-3938

  The "reset password" login page accepted an HTML injection via URL parameters. This has already been rectified via patch, and as such it cannot be demonstrated…

  dotCMS · dotCMS core

  Medium5.4
• CVE-2024-3165

  Database Credential Exposure in the Logs

  dotCMS · dotCMS core

  Medium4.5
• CVE-2024-3164

  In dotCMS dashboard, the Tools and Log Files tabs under System → Maintenance Portlet, which is and always has been an Admin portlet, is accessible to anyone…

  dotCMS · dotCMS core

  Medium4.5
• CVE-2023-3042

  CNA SHORTNAME: dotCMSORG UUID: 5b9d93f2-25c7-46b4-ab60-d201718c9dd8

  dotCMS · dotCMS core

  Medium5.3