Aggregates CVE and security vulnerability intelligence across all dotCMS-related products, including CVSS, EPSS, publication dates, and vulnerability intelligence data.
Common weakness patterns include vendor risk csrf, vendor risk ssrf, vendor risk open redirect, and vendor risk input validation, with potential vendor impact data exposure across vendor surface production workloads use cases.
| CVE | Summary | Source | Max CVSS | EPSS % | Published | Updated |
|---|---|---|---|---|---|---|
| CVE-2020-6754 | dotCMS before 5.2.4 is vulnerable to directory traversal, leading to incorrect access control. It allows an attacker to read or execute files under $TOMCAT_HOME/webapps/ROOT/assets (which should be a protected directory). Additionally, attackers can upload temporary files (e.g., .jsp files) into /webapps/ROOT/assets/tmp_upload, which can lead to remote command execution (with the permissions of the user running the dotCMS application). | [email protected] | 9.8 | 94.80% | 2020-02-05 | 2024-11-21 |
| CVE-2019-12872 | dotCMS before 5.1.6 is vulnerable to a SQL injection that can be exploited by an attacker of the role Publisher via view_unpushed_bundles.jsp. | [email protected] | 7.2 | 1.28% | 2019-06-18 | 2024-11-21 |
| CVE-2019-12309 | dotCMS before 5.1.0 has a path traversal vulnerability exploitable by an administrator to create files. The vulnerability is caused by the insecure extraction of a ZIP archive. | [email protected] | 4.9 | 1.28% | 2019-05-23 | 2024-11-21 |
| CVE-2019-11846 | /servlets/ajax_file_upload?fieldName=binary3 in dotCMS 5.1.1 allows XSS and HTML Injection. | [email protected] | 6.1 | 1.00% | 2019-05-14 | 2024-11-21 |
| CVE-2018-17422 | dotCMS before 5.0.2 has open redirects via the html/common/forward_js.jsp FORWARD_URL parameter or the html/portlet/ext/common/page_preview_popup.jsp hostname parameter. | [email protected] | 6.1 | 3.59% | 2019-03-07 | 2024-11-21 |
| CVE-2018-19554 | An issue was discovered in Dotcms through 5.0.3. Attackers may perform XSS attacks via the inode, identifier, or fieldName parameter in html/js/dotcms/dijit/image/image_tool.jsp. | [email protected] | 5.4 | 0.60% | 2018-11-26 | 2024-11-21 |
| CVE-2018-16980 | dotCMS V5.0.1 has XSS in the /html/portlet/ext/contentlet/image_tools/index.jsp fieldName and inode parameters. | [email protected] | 6.1 | 0.84% | 2018-09-12 | 2024-11-21 |
| CVE-2017-3189 | The dotCMS administration panel, versions 3.7.1 and earlier, "Push Publishing" feature in Enterprise Pro is vulnerable to arbitrary file upload. When "Bundle" tar.gz archives uploaded to the Push Publishing feature are decompressed, there are no checks on the types of files which the bundle contains. This vulnerability combined with the path traversal vulnerability (CVE-2017-3188) can lead to remote command execution with the permissions of the user running the dotCMS application. An unauthentic | [email protected] | 8.1 | 6.55% | 2018-07-24 | 2024-11-21 |
| CVE-2017-3188 | The dotCMS administration panel, versions 3.7.1 and earlier, "Push Publishing" feature in Enterprise Pro is vulnerable to path traversal. When "Bundle" tar.gz archives uploaded to the Push Publishing feature are decompressed, the filenames of its contents are not properly checked, allowing for writing files to arbitrary directories on the file system. These archives may be uploaded directly via the administrator panel, or using the CSRF vulnerability (CVE-2017-3187). An unauthenticated remote at | [email protected] | 6.5 | 2.79% | 2018-07-24 | 2024-11-21 |
| CVE-2017-3187 | The dotCMS administration panel, versions 3.7.1 and earlier, are vulnerable to cross-site request forgery. The dotCMS administrator panel contains a cross-site request forgery (CSRF) vulnerability. An attacker can perform actions with the same permissions as a victim user, provided the victim has an active session and is induced to trigger the malicious request. An unauthenticated remote attacker may perform actions with the dotCMS administrator panel with the same permissions of a victim user o | [email protected] | 8.8 | 1.14% | 2018-07-24 | 2024-11-21 |
| CVE-2016-10008 | SQL injection vulnerability in the "Content Types > Content Types" screen in dotCMS before 3.7.2 and 4.x before 4.1.1 allows remote authenticated administrators to execute arbitrary SQL commands via the _EXT_STRUCTURE_direction parameter. | [email protected] | 7.2 | 1.31% | 2018-02-19 | 2024-11-21 |
| CVE-2016-10007 | SQL injection vulnerability in the "Marketing > Forms" screen in dotCMS before 3.7.2 and 4.x before 4.1.1 allows remote authenticated administrators to execute arbitrary SQL commands via the _EXT_FORM_HANDLER_orderBy parameter. | [email protected] | 7.2 | 1.31% | 2018-02-19 | 2024-11-21 |
| CVE-2017-15219 | The dotCMS 4.1.1 application is vulnerable to Stored Cross-Site Scripting (XSS) affecting a vanity-urls Title field, a containers Description field, and a templates Description field. | [email protected] | 5.4 | 0.51% | 2017-10-10 | 2026-05-13 |
| CVE-2017-11466 | Arbitrary file upload vulnerability in com/dotmarketing/servlets/AjaxFileUploadServlet.class in dotCMS 4.1.1 allows remote authenticated administrators to upload .jsp files to arbitrary locations via directory traversal sequences in the fieldName parameter to servlets/ajax_file_upload. This results in arbitrary code execution by requesting the .jsp file at a /assets URI. | [email protected] | 7.2 | 7.70% | 2017-07-20 | 2026-05-13 |
| CVE-2017-6003 | dotCMS 3.7.0 has XSS reachable from ext/languages_manager/edit_language in portal/layout via the bottom two form fields. | [email protected] | 6.1 | 0.76% | 2017-03-27 | 2026-05-13 |
| CVE-2017-5344 | An issue was discovered in dotCMS through 3.6.1. The findChildrenByFilter() function which is called by the web accessible path /categoriesServlet performs string interpolation and direct SQL query execution. SQL quote escaping and a keyword blacklist were implemented in a new class, SQLUtil (main/java/com/dotmarketing/common/util/SQLUtil.java), as part of the remediation of CVE-2016-8902; however, these can be overcome in the case of the q and inode parameters to the /categoriesServlet path. Ov | [email protected] | 9.8 | 6.30% | 2017-02-17 | 2026-05-13 |
| CVE-2017-5877 | XSS was discovered in dotCMS 3.7.0, with an unauthenticated attack against the /about-us/locations/index direction parameter. | [email protected] | 6.1 | 0.92% | 2017-02-06 | 2026-05-13 |
| CVE-2017-5876 | XSS was discovered in dotCMS 3.7.0, with an unauthenticated attack against the /news-events/events date parameter. | [email protected] | 6.1 | 0.92% | 2017-02-06 | 2026-05-13 |
| CVE-2017-5875 | XSS was discovered in dotCMS 3.7.0, with an authenticated attack against the /myAccount addressID parameter. | [email protected] | 5.4 | 0.55% | 2017-02-06 | 2026-05-13 |
| CVE-2016-2355 | SQL injection vulnerability in the REST API in dotCMS before 3.3.2 allows remote attackers to execute arbitrary SQL commands via the stName parameter to api/content/save/1. | [email protected] | 9.8 | 2.10% | 2016-12-19 | 2026-05-06 |