CVE-2016-8907

DotCMS Content Types) that allows a remote authenticated user to inject arbitrary SQL via the orderby parameter. Root cause: improper handling of the orderby parameter leads to SQL command execution with partial/high impact on confidentiality, integrity, and availability as per CVSS data. Affect...

dotCMS 3.x SQL Injection

Title: Multiple SQL injection vulnerabilities in dotCMS 8x CVE Credit: Elar Lang / https://security.elarlang.eu Vendor/Product: dotCMS http://dotcms.com/ Vulnerability: SQL injection Vulnerable version: before 3.5; 3.3.1 and 3.3.2 depends on CVE CVE: CVE-2016-8902, CVE-2016-8903, CVE-2016-8904,...