CVE Program partner

dotCMS

dotCMS LLC

API
CVEs, 365 days39 all time, 0 rejected
Quality100%median 99%
CVSS by the CNA100%share of records
CWE100%share of records
Affected versions100%not n/a or unspecified
CVSS added by CISA0%lower is better
OrganisationdotCMS LLC
RoleCNA
TypeHosted Service
Reports tomitre
ScopeAll dotCMS product services including the vulnerabilities reported in our open source core located at <a href='https://github.com/dotCMS/core' target='_blank'>https://github.com/dotCMS/core</a>.
Advisorieshttps://www.dotcms.com/docs/latest/known-security-issues

Latest CVEs · RSS

  • CVE-2026-16337 2026-07-20 · CVSS 9.4
    Improper authorization in the ToolGroupResource and RoleAjax REST/DWR endpoints in dotCMS dotCMS 21.02 through 26.06.22-03 on all platforms allows a low-privile
  • CVE-2026-8054 2026-05-27 · CVSS 10.0
    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in the Publish Audit API endpoints (/api/auditPublishing/get and /api/audit
  • CVE-2025-11165 2026-02-24 · CVSS 9.4
    A sandbox escape vulnerability exists in dotCMS’s Velocity scripting engine (VTools) that allows authenticated users with scripting privileges to bypass class a
  • CVE-2025-8311 2025-09-04 · CVSS 9.4
    dotCMS versions 24.03.22 and after, identified a Boolean-based blind SQLi vulnerability in the /api/v1/contenttype endpoint. This endpoint uses the sites query
  • CVE-2024-4447 2024-07-26 · CVSS 9.9
    In the System → Maintenance tool, the Logged Users tab surfaces sessionId data for all users via the Direct Web Remoting API (UserSessionAjax.getSessionList.dwr
  • CVE-2024-3938 2024-07-25 · CVSS 5.4
    The "reset password" login page accepted an HTML injection via URL parameters. This has already been rectified via patch, and as such it cannot be demonstrated
  • CVE-2024-3165 2024-04-01 · CVSS 4.5
    System->Maintenance-> Log Files in dotCMS dashboard is providing the username/password for database connections in the log output. Nevertheless, this is a moder
  • CVE-2024-3164 2024-04-01 · CVSS 4.5
    In dotCMS dashboard, the Tools and Log Files tabs under System → Maintenance Portlet, which is and always has been an Admin portlet, is accessible to anyone wit
  • CVE-2023-3042 2023-10-17 · CVSS 5.3
    In dotCMS, versions mentioned, a flaw in the NormalizationFilter does not strip double slashes (//) from URLs, potentially enabling bypasses for XSS and access

All CVE Program partners