Product by dotCMS
dotCMS core
58 known vulnerabilities in dotCMS core (dotCMS), 1 of them actively exploited (CISA KEV).
Key figures
58
Vulnerabilities
1
Actively exploited (KEV)
1
Used by ransomware
8
Critical
Vulnerabilities
Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.
| Critical | CVE-2022-26352 | dotCMS Unrestricted Upload of File Vulnerability In CISA KEVRansomware | 9.8 | |
| Critical | CVE-2020-6754 | dotCMS: Path Traversal | 9.8 | |
| Critical | CVE-2017-5344 | dotCMS: SQL Injection | 9.8 | |
| Critical | CVE-2020-19138 | dotCMS: Code Execution | 9.8 | |
| High | CVE-2017-3189 | docCMS Administration Panel: Unrestricted Upload of File with Dangerous Type | 8.1 | |
| Critical | CVE-2016-8902 | dotCMS: SQL Injection | 9.8 | |
| High | CVE-2017-11466 | dotCMS: Path Traversal | 7.2 | |
| Medium | CVE-2022-45783 | dotCMS: Path Traversal | 6.5 | |
| Critical | CVE-2016-2355 | dotCMS: SQL Injection | 9.8 | |
| High | CVE-2016-8906 | dotCMS: SQL Injection | 8.8 | |
| High | CVE-2016-8905 | dotCMS: SQL Injection | 8.8 | |
| High | CVE-2016-8908 | dotCMS: SQL Injection | 8.8 | |
| High | CVE-2016-8907 | dotCMS: SQL Injection | 8.8 | |
| High | CVE-2020-18875 | dotCMS: Improper Access Control | 8.8 | |
| High | CVE-2016-8904 | dotCMS: SQL Injection | 8.8 | |
| High | CVE-2016-8903 | dotCMS: SQL Injection | 8.8 | |
| Medium | CVE-2018-17422 | dotCMS: Open Redirect | 6.1 | |
| Medium | CVE-2017-3188 | docCMS Administration Panel: Path Traversal | 6.5 | |
| High | CVE-2016-4803 | dotCMS: CRLF Injection | 7.5 | |
| Critical | CVE-2026-16337 | dotCMS: Improper Privilege Management | — | |
| High | CVE-2016-8600 | dotCMS: security vulnerability | 7.5 | |
| High | CVE-2020-27848 | dotCMS: SQL Injection | 8.8 | |
| High | CVE-2017-3187 | docCMS Administration Panel: Cross-Site Request Forgery (CSRF) | 8.8 | |
| Medium | CVE-2016-3688 | dotCMS: SQL Injection | 6.5 | |
| High | CVE-2016-4040 | dotCMS: SQL Injection | 7.2 |