CVE-2016-8907

DotCMS Content Types) that allows a remote authenticated user to inject arbitrary SQL via the orderby parameter. Root cause: improper handling of the orderby parameter leads to SQL command execution with partial/high impact on confidentiality, integrity, and availability as per CVSS data. Affect...

CVE-2016-8908

SQL injection vulnerability in the "Site Browser HTML pages" screen in dotCMS before 3.3.1 allows remote authenticated attackers to execute arbitrary SQL commands via the orderby parameter...

CVE-2016-8908

CVE-2016-8908 affects dotCMS HTML pages screen, exploitable via the orderby parameter to allow remote authenticated attackers to execute arbitrary SQL commands. Affected versions are before 3.3.1; the vulnerability can impact data confidentiality, integrity, and availability as implied by the SQ...

CVE-2016-8903

SQL injection vulnerability in the "Site Browser Templates pages" screen in dotCMS before 3.3.1 allows remote authenticated attackers to execute arbitrary SQL commands via the orderby parameter...

CVE-2016-8904

SQL injection vulnerability in the "Site Browser Containers pages" screen in dotCMS before 3.3.1 allows remote authenticated attackers to execute arbitrary SQL commands via the orderby parameter...

CVE-2016-8905

SQL injection vulnerability in the JSONTags servlet in dotCMS before 3.3.1 allows remote authenticated attackers to execute arbitrary SQL commands via the sort parameter...

CVE-2016-8906

SQL injection vulnerability in the "Site Browser Links pages" screen in dotCMS before 3.3.1 allows remote authenticated attackers to execute arbitrary SQL commands via the orderby parameter...

CVE-2016-8907

SQL injection vulnerability in the "Content Types Content Types" screen in dotCMS before 3.3.1 allows remote authenticated attackers to execute arbitrary SQL commands via the orderby parameter...

CVE-2016-8903

CVE-2016-8903 affects dotCMS before 3.3.1. The issue is a SQL injection in the Site Browser > Templates pages screen, exploitable via the _EXT_13_orderby parameter. Remote authenticated attackers can execute arbitrary SQL commands. The public documents consistently describe the vulnerability a...

CVE-2016-8904

CVE-2016-8904 affects dotCMS prior to 3.3.1. The vulnerability is a SQL injection in the Site Browser > Containers pages screen, exploitable via the orderby parameter. The issue allows remote authenticated attackers to execute arbitrary SQL commands, with impact described as partial confidenti...

CVE-2016-8905

CVE-2016-8905 affects dotCMS

CVE-2016-8902: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in the categoriesServlet servlet in dotCMS before 3.3.1 allows remote not authenticated attackers to execute arbitrary SQL commands via the sort parameter...

CVE-2016-8907: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in the "Content Types Content Types" screen in dotCMS before 3.3.1 allows remote authenticated attackers to execute arbitrary SQL commands via the orderby parameter...

CVE-2016-8908: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in the "Site Browser HTML pages" screen in dotCMS before 3.3.1 allows remote authenticated attackers to execute arbitrary SQL commands via the orderby parameter...

CVE-2016-8906: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in the "Site Browser Links pages" screen in dotCMS before 3.3.1 allows remote authenticated attackers to execute arbitrary SQL commands via the orderby parameter...

CVE-2016-8903: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in the "Site Browser Templates pages" screen in dotCMS before 3.3.1 allows remote authenticated attackers to execute arbitrary SQL commands via the orderby parameter...

CVE-2016-8904: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in the "Site Browser Containers pages" screen in dotCMS before 3.3.1 allows remote authenticated attackers to execute arbitrary SQL commands via the orderby parameter...

CVE-2016-8905: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in the JSONTags servlet in dotCMS before 3.3.1 allows remote authenticated attackers to execute arbitrary SQL commands via the sort parameter...

DotCMS SQL Injection Vulnerability (CNVD-2016-11005)

DotCMS is a content management system CMS from the American company DotCMS. The system supports RSS feeds , blogs , forums and other modules , and is easy to extend and build features . A SQL injection vulnerability exists in the Site Browser Links page screen in versions of DotCMS prior to 3.3.1...

DotCMS SQL Injection Vulnerability (CNVD-2016-11004)

DotCMS is a content management system CMS from the American company DotCMS. The system supports RSS feeds , blogs , forums and other modules , and is easy to extend and build features . A SQL injection vulnerability exists in the JSONTags servlet in versions of DotCMS prior to 3.3.1. A remote...