Dotcms Core (Dotcms) - vulnerabilities (CVEs)

6 CVEs, 0 in the last 30 days, 6 known versions, newest CVE from 2026-05-27. Vendor: Dotcms.

CVEs of Dotcms Core

• CVE-2026-8054 - CVSS 10 (critical), 2026-05-27: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in the Publish Audit API endpoints (/api/auditPublishing/get and…
• CVE-2024-4447 - CVSS 9.9 (critical), 2024-07-26: In the System → Maintenance tool, the Logged Users tab surfaces sessionId data for all users via the Direct Web Remoting API…
• CVE-2024-3938 - CVSS 6.1 (medium), 2024-07-25: The "reset password" login page accepted an HTML injection via URL parameters. This has already been rectified via patch, and as such it cannot be…
• CVE-2024-3165 - CVSS 4.5 (medium), 2024-04-01: System->Maintenance-> Log Files in dotCMS dashboard is providing the username/password for database connections in the log output. Nevertheless, this is a…
• CVE-2024-3164 - CVSS 4.5 (medium), 2024-04-01: In dotCMS dashboard, the Tools and Log Files tabs under System → Maintenance Portlet, which is and always has been an Admin portlet, is accessible to anyone…
• CVE-2023-3042 - CVSS 6.1 (medium), 2023-10-17: In dotCMS, versions mentioned, a flaw in the NormalizationFilter does not strip double slashes (//) from URLs, potentially enabling bypasses for XSS and…