Doramart vulnerabilities
We track 3 vulnerabilities in Doramart products. 3 are rated high or critical, and none are known to be exploited. The most recent was published on November 2, 2026.
Latest Doramart vulnerabilities
- 8.1 High severity
DoraCMS: Improperly Controlled Modification of Dynamically-Determined Object Attributes
DoraCMS through 3.1.0 contains a mass assignment vulnerability in the PUT /api/v1/user/api-keys/:id endpoint that allows authenticated low-privileged users to rebind their API key to another user's account. Attackers can set the userId field on their own key t
- 9.8 Critical severity
DoraCMS: Improper Limitation of a Pathname to a Restricted Directory
A security flaw has been discovered in doramart DoraCMS 3.0.x. Impacted is the function createFileBypath of the file /DoraCMS/server/app/router/api/v1.js. Performing a manipulation results in path traversal. The attack can be initiated remotely. The exploit ha
- 9.8 Critical severity
DoraCMS: Improper Authentication
A vulnerability was identified in doramart DoraCMS 3.0.x. This issue affects some unknown processing of the file /api/v1/mail/send of the component Email API. Such manipulation leads to improper authentication. It is possible to launch the attack remotely. The