Vendor

    dotCMS

    61 known vulnerabilities in products by dotCMS, 1 of them actively exploited (CISA KEV).

    Key figures

    61

    Vulnerabilities

    1

    Actively exploited (KEV)

    1

    Used by ransomware

    11

    Critical

    Vulnerabilities

    Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.

    Vulnerabilities in dotCMS
    CriticalCVE-2022-26352

    dotCMS Unrestricted Upload of File Vulnerability

    In CISA KEVRansomware

    		9.8
    CriticalCVE-2020-6754

    dotCMS: Path Traversal

    		9.8
    CriticalCVE-2017-5344

    dotCMS: SQL Injection

    		9.8
    CriticalCVE-2020-19138

    dotCMS: Code Execution

    		9.8
    CriticalCVE-2026-8054

    Unauthenticated SQL Injection in dotCMS Publish Audit API

    		—
    HighCVE-2017-3189

    docCMS Administration Panel: Unrestricted Upload of File with Dangerous Type

    also in 1 other product

    		8.1
    CriticalCVE-2016-8902

    dotCMS: SQL Injection

    		9.8
    HighCVE-2017-11466

    dotCMS: Path Traversal

    		7.2
    MediumCVE-2022-45783

    dotCMS: Path Traversal

    		6.5
    CriticalCVE-2025-8311

    dotCMS Cloud Services (dCS): SQL Injection

    		—
    CriticalCVE-2016-2355

    dotCMS: SQL Injection

    		9.8
    HighCVE-2016-8906

    dotCMS: SQL Injection

    		8.8
    HighCVE-2016-8905

    dotCMS: SQL Injection

    		8.8
    HighCVE-2016-8908

    dotCMS: SQL Injection

    		8.8
    HighCVE-2016-8907

    dotCMS: SQL Injection

    		8.8
    HighCVE-2020-18875

    dotCMS: Improper Access Control

    		8.8
    HighCVE-2016-8904

    dotCMS: SQL Injection

    		8.8
    HighCVE-2016-8903

    dotCMS: SQL Injection

    		8.8
    MediumCVE-2018-17422

    dotCMS: Open Redirect

    		6.1
    MediumCVE-2017-3188

    docCMS Administration Panel: Path Traversal

    also in 1 other product

    		6.5
    HighCVE-2016-4803

    dotCMS: CRLF Injection

    		7.5
    CriticalCVE-2026-16337

    dotCMS: Improper Privilege Management

    		—
    HighCVE-2016-8600

    dotCMS: security vulnerability

    		7.5
    HighCVE-2020-27848

    dotCMS: SQL Injection

    		8.8
    HighCVE-2017-3187

    docCMS Administration Panel: Cross-Site Request Forgery (CSRF)

    also in 1 other product

    		8.8

    All vulnerabilities in search

    Products

    Products by dotCMS
    dotCMS core581
    Dotcms Core60