dotCMS dotCMS core vulnerabilities

CVEs per yearBy the year they were published

1. 20231
2. 20244
3. 20261

Newest CVEs

• CVE-2026-8054

  Unauthenticated SQL Injection in dotCMS Publish Audit API

  dotCMS · dotCMS Core

  Critical10.0
• CVE-2024-4447

  In the System → Maintenance tool, the Logged Users tab surfaces sessionId data for all users via the Direct Web Remoting API…

  dotCMS · dotCMS core

  Critical9.9
• CVE-2024-3938

  The "reset password" login page accepted an HTML injection via URL parameters. This has already been rectified via patch, and as such it cannot be demonstrated…

  dotCMS · dotCMS core

  Medium5.4
• CVE-2024-3165

  Database Credential Exposure in the Logs

  dotCMS · dotCMS core

  Medium4.5
• CVE-2024-3164

  In dotCMS dashboard, the Tools and Log Files tabs under System → Maintenance Portlet, which is and always has been an Admin portlet, is accessible to anyone…

  dotCMS · dotCMS core

  Medium4.5
• CVE-2023-3042

  CNA SHORTNAME: dotCMSORG UUID: 5b9d93f2-25c7-46b4-ab60-d201718c9dd8

  dotCMS · dotCMS core

  Medium5.3