dotCMS
Products
| Product | CVEs | Exploited | Latest |
|---|---|---|---|
| dotCMS Core | 6 | – | May 27, 2026 |
| dotCMS | 2 | – | Jul 20, 2026 |
| dotCMS Cloud Services (dCS) | 1 | – | Sep 4, 2025 |
Exploited and recent CVEs
- CVE-2026-16337 Improper authorization in the ToolGroupResource and RoleAjax REST/DWR endpoints in dotCMS dotCMS 21.02 through 26.06.22-03 on all platforms allows a low-privileged authenticated backend user to self-a 0.6%
- CVE-2026-8054 Unauthenticated SQL Injection in dotCMS Publish Audit API 1.6%
- CVE-2025-11165 A sandbox escape vulnerability exists in dotCMS’s Velocity scripting engine (VTools) that allows authenticated users with scripting privileges to bypass class and package restrictions enforced by Secu 0.3%
- CVE-2025-8311 dotCMS versions 24.03.22 and after, identified a Boolean-based blind SQLi vulnerability in the /api/v1/contenttype endpoint. This endpoint uses the sites query parameter, which accepts a comma-separat 1.7%
- CVE-2024-4447 In the System → Maintenance tool, the Logged Users tab surfaces sessionId data for all users via the Direct Web Remoting API (UserSessionAjax.getSessionList.dwr) calls. While this is information that 0.5%
- CVE-2024-3938 The "reset password" login page accepted an HTML injection via URL parameters. This has already been rectified via patch, and as such it cannot be demonstrated via Demo site link. Those interested to 0.3%
- CVE-2024-3165 Database Credential Exposure in the Logs 0.5%
- CVE-2024-3164 In dotCMS dashboard, the Tools and Log Files tabs under System → Maintenance Portlet, which is and always has been an Admin portlet, is accessible to anyone with that portlet and not just to CMS Admin 0.5%
- CVE-2023-3042 CNA SHORTNAME: dotCMSORG UUID: 5b9d93f2-25c7-46b4-ab60-d201718c9dd8 0.4%