CVE-2016-8906

DotCMS prior to 3.3.1 is affected by a SQL injection vulnerability in the Site Browser > Links pages screen, exploitable via the orderby parameter by remote authenticated attackers. The issue corresponds to CVE-2016-8906. According to the NVD entry, the CVSS v3 base score is 8.8 (High) with ne...

CVE-2016-8902

SQL injection vulnerability in the categoriesServlet servlet in dotCMS before 3.3.1 allows remote not authenticated attackers to execute arbitrary SQL commands via the sort parameter...

CVE-2016-8902

The CVE-2016-8902 entry describes a SQL injection in dotCMS (categoriesServlet) before version 3.3.1, allowing remote unauthenticated attackers to execute arbitrary SQL via the sort parameter. This is confirmed by multiple sources (NVD, OSV, OpenVAS notes). The documents do not provide a specific...

CVE-2016-8908

SQL injection vulnerability in the "Site Browser HTML pages" screen in dotCMS before 3.3.1 allows remote authenticated attackers to execute arbitrary SQL commands via the orderby parameter...

CVE-2016-8908

CVE-2016-8908 affects dotCMS HTML pages screen, exploitable via the orderby parameter to allow remote authenticated attackers to execute arbitrary SQL commands. Affected versions are before 3.3.1; the vulnerability can impact data confidentiality, integrity, and availability as implied by the SQ...

CVE-2016-8907

DotCMS Content Types) that allows a remote authenticated user to inject arbitrary SQL via the orderby parameter. Root cause: improper handling of the orderby parameter leads to SQL command execution with partial/high impact on confidentiality, integrity, and availability as per CVSS data. Affect...

CVE-2016-8905

SQL injection vulnerability in the JSONTags servlet in dotCMS before 3.3.1 allows remote authenticated attackers to execute arbitrary SQL commands via the sort parameter...

CVE-2016-8903

CVE-2016-8903 affects dotCMS before 3.3.1. The issue is a SQL injection in the Site Browser > Templates pages screen, exploitable via the _EXT_13_orderby parameter. Remote authenticated attackers can execute arbitrary SQL commands. The public documents consistently describe the vulnerability a...

CVE-2016-8904

CVE-2016-8904 affects dotCMS prior to 3.3.1. The vulnerability is a SQL injection in the Site Browser > Containers pages screen, exploitable via the orderby parameter. The issue allows remote authenticated attackers to execute arbitrary SQL commands, with impact described as partial confidenti...

CVE-2016-8903

SQL injection vulnerability in the "Site Browser Templates pages" screen in dotCMS before 3.3.1 allows remote authenticated attackers to execute arbitrary SQL commands via the orderby parameter...

CVE-2016-8906

SQL injection vulnerability in the "Site Browser Links pages" screen in dotCMS before 3.3.1 allows remote authenticated attackers to execute arbitrary SQL commands via the orderby parameter...

CVE-2016-8907

SQL injection vulnerability in the "Content Types Content Types" screen in dotCMS before 3.3.1 allows remote authenticated attackers to execute arbitrary SQL commands via the orderby parameter...

CVE-2016-8904

SQL injection vulnerability in the "Site Browser Containers pages" screen in dotCMS before 3.3.1 allows remote authenticated attackers to execute arbitrary SQL commands via the orderby parameter...

CVE-2016-8905

CVE-2016-8905 affects dotCMS

CVE-2016-8902: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in the categoriesServlet servlet in dotCMS before 3.3.1 allows remote not authenticated attackers to execute arbitrary SQL commands via the sort parameter...

CVE-2016-8907: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in the "Content Types Content Types" screen in dotCMS before 3.3.1 allows remote authenticated attackers to execute arbitrary SQL commands via the orderby parameter...

PT-2016-7611

Name of the Vulnerable Software and Affected Versions dotCMS versions prior to 3.3.1 Description The issue allows remote authenticated attackers to execute arbitrary SQL commands. This is achieved via the orderby parameter in the "Site Browser Containers pages" screen. Recommendations For version...

CVE-2016-8908: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in the "Site Browser HTML pages" screen in dotCMS before 3.3.1 allows remote authenticated attackers to execute arbitrary SQL commands via the orderby parameter...

CVE-2016-8906: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in the "Site Browser Links pages" screen in dotCMS before 3.3.1 allows remote authenticated attackers to execute arbitrary SQL commands via the orderby parameter...

CVE-2016-8903: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in the "Site Browser Templates pages" screen in dotCMS before 3.3.1 allows remote authenticated attackers to execute arbitrary SQL commands via the orderby parameter...