dotCMS core vulnerabilities

2 known vulnerabilities in dotCMS core from dotCMS. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 10.0 Critical severity

  dotCMS Core: Improper Neutralization of Special Elements used in an SQL Command

  CVE-2026-8054May 27, 2026dotCMSEPSS 1.58%

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in the Publish Audit API endpoints (/api/auditPublishing/get and /api/auditPublishing/getAll) in dotCMS Core 25.11.04-1 through 26.04.28-02 allows remote unauthenticated attac

• 9.9 Critical severity

  dotCMS core: Incorrect Authorization

  CVE-2024-4447Jul 26, 2024dotCMS

  In the System → Maintenance tool, the Logged Users tab surfaces sessionId data for all users via the Direct Web Remoting API (UserSessionAjax.getSessionList.dwr) calls. While this is information that would and should be available to admins who possess "Sign In