dotCMS dotCMS Core

• CVE-2026-8054 Critical 10.0 Unauthenticated SQL Injection in dotCMS Publish Audit API 1.6%
• CVE-2024-4447 Critical 9.9 In the System → Maintenance tool, the Logged Users tab surfaces sessionId data for all users via the Direct Web Remoting API (UserSessionAjax.getSessionList.dwr) calls. While this is information that 0.5%
• CVE-2024-3938 Medium 5.4 The "reset password" login page accepted an HTML injection via URL parameters. This has already been rectified via patch, and as such it cannot be demonstrated via Demo site link. Those interested to 0.3%
• CVE-2024-3165 Medium 4.5 Database Credential Exposure in the Logs 0.5%
• CVE-2024-3164 Medium 4.5 In dotCMS dashboard, the Tools and Log Files tabs under System → Maintenance Portlet, which is and always has been an Admin portlet, is accessible to anyone with that portlet and not just to CMS Admin 0.5%
• CVE-2023-3042 Medium 5.3 CNA SHORTNAME: dotCMSORG UUID: 5b9d93f2-25c7-46b4-ab60-d201718c9dd8 0.4%