CVE-2022-37033

In dotCMS 5.x-22.06, TempFileAPI allows a user to create a temporary file based on a passed in URL, while attempting to block any SSRF access to local IP addresses or private subnets. In resolving this URL, the TempFileAPI follows any 302 redirects that the remote URL returns. Because there is no...

CVE-2019-12309

dotCMS before 5.1.0 has a path traversal vulnerability exploitable by an administrator to create files. The vulnerability is caused by the insecure extraction of a ZIP archive...

EUVD-2018-11243

Malware in sbrugna...

EUVD-2017-3087

Malware in sbrugna...

EUVD-2018-8766

Malware in sbrugna...

EUVD-2017-6679

Malware in sbrugna...

EUVD-2016-1205

Malware in sbrugna...

EUVD-2016-4981

Malware in sbrugna...

EUVD-2017-15071

Malware in sbrugna...

EUVD-2017-14449

Malware in sbrugna...

EUVD-2016-5786

Malware in sbrugna...

EUVD-2017-12315

Malware in sbrugna...

EUVD-2019-3946

Malware in sbrugna...

EUVD-2017-12314

Malware in sbrugna...

EUVD-2017-12313

Malware in sbrugna...

EUVD-2022-38613

Malicious code in bioql PyPI...

VulnCheck KEV: CVE-2025-8311

dotCMS versions 24.03.22 and after, identified a Boolean-based blind SQLi vulnerability in the /api/v1/contenttype endpoint. This endpoint uses the sites query parameter, which accepts a comma-separated list of site identifiers or keys. The vulnerability was triggered via the sites parameter, whi...

CVE-2023-3042

In dotCMS, versions mentioned, a flaw in the NormalizationFilter does not strip double slashes // from URLs, potentially enabling bypasses for XSS and access controls. An example affected URL is https://demo.dotcms.com//html/portlet/ext/files/edittextinc.jsp , which should return a 404 response b...

CVE-2022-37034

In dotCMS 5.x-22.06, it is possible to call the TempResource multiple times, each time requesting the dotCMS server to download a large file. If done repeatedly, this will result in Tomcat request-thread exhaustion and ultimately a denial of any other requests...

CVE-2020-19138

Unrestricted Upload of File with Dangerous Type in DotCMS v5.2.3 and earlier allow remote attackers to execute arbitrary code via the component "/src/main/java/com/dotmarketing/filters/CMSFilter.java"...