Advisories · Technology

dotCMS Core.

Every CVE that names dotCMS Core among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.

CVE-2026-8054 CVE record

CVSS 10.0 CriticalCritical · CVSS 9+

Unauthenticated SQL Injection in dotCMS Publish Audit API
- dotCMS Core
- SQL injection
Not analysed yet 27 May 2026
CVE-2024-4447 CVE record

CVSS 9.9 CriticalCritical · CVSS 9+

Incorrect authorization in dotCMS core
- dotCMS core
- Broken access control
Not analysed yet 26 Jul 2024
CVE-2024-3938 CVE record

CVSS 5.4 Medium

Improper input validation in dotCMS core
- dotCMS core
- CWE-20
Not analysed yet 25 Jul 2024
CVE-2024-3165 CVE record

CVSS 4.5 Medium

Database Credential Exposure in the Logs
- dotCMS core
- Information disclosure
Not analysed yet 1 Apr 2024
CVE-2024-3164 CVE record

CVSS 4.5 Medium

Improper access control in dotCMS core
- dotCMS core
- Broken access control
Not analysed yet 1 Apr 2024
CVE-2023-3042 CVE record

CVSS 5.3 Medium

CNA SHORTNAME: dotCMSORG UUID: 5b9d93f2-25c7-46b4-ab60-d201718c9dd8
- dotCMS core
- Cross-site scripting (XSS)
Not analysed yet 17 Oct 2023