CVE-2019-12872

dotCMS before 5.1.6 is vulnerable to a SQL injection that can be exploited by an attacker of the role Publisher via viewunpushedbundles.jsp...

CVE-2019-12872

DotCMS prior to 5.1.6 is vulnerable to a SQL injection that can be exploited by an attacker with Publisher role via view_unpushed_bundles.jsp. Root cause described in CNVD note as lack of validation of externally entered SQL statements in database-based apps. Impact per sources is execution of il...