Skip to content
OpenAdvisories

Vendor

dotCMS

9 known vulnerabilities.

Products

dotCMS Core 6 dotCMS 2 dotCMS Cloud Services (dCS) 1
All Critical High Medium Low Exploited only Public exploit

5 results · Clear filters · Feed

  • Critical 9.4
    CVE-2026-16337

    Improper authorization in the ToolGroupResource and RoleAjax REST/DWR endpoints in dotCMS dotCMS 21.02 through 26.06.22…

    dotCMS dotCMS
  • Critical 10.0
    CVE-2026-8054 Public exploit

    Unauthenticated SQL Injection in dotCMS Publish Audit API

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in the Publish Audit API endpoints (/api/auditPublishing/get and /api/auditPublishing/getAll) in dotCMS Core 25.11.04-1 through 26.04.28-02 allows remote unauthenticated atta…

    dotCMS dotCMS Core
  • Critical 9.4
    CVE-2025-11165

    A sandbox escape vulnerability exists in dotCMS’s Velocity scripting engine (VTools) that allows authenticated users wi…

    dotCMS dotCMS
  • Critical 9.4
    CVE-2025-8311 Public exploit

    dotCMS versions 24.03.22 and after, identified a Boolean-based blind SQLi vulnerability in the /api/v1/contenttype endp…

    dotCMS dotCMS Cloud Services (dCS)
  • Critical 9.9
    CVE-2024-4447

    In the System → Maintenance tool, the Logged Users tab surfaces sessionId data for all users via the Direct Web Remotin…

    dotCMS dotCMS Core