dotCMS vulnerabilities
CVEs whose affected-version data names the dotCMS package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
2 CVEsRSS
CVE-2026-16337Critical· 9.4Improper authorization in the ToolGroupResource and RoleAjax REST/DWR endpoints in dotCMS dotCMS 21.02 through 26.06.22-03 on all platforms allows a low-privileged authenticated backend user to self-assign the administrative layout and s…
Improper authorization in the ToolGroupResource and RoleAjax REST/DWR endpoints in dotCMS dotCMS 21.02 through 26.06.22-03 on all platforms allows a low-privileged authenticated backend user to self-assign the administrative layout and s…
▾ MidnightdotCMS · dotCMSEPSS 0.58%via CVEORG
CVE-2020-35274Medium· 4.8DotCMS Add Template with admin panel 20.11 is affected by cross-site Scripting (XSS) to gain remote privileges
DotCMS Add Template with admin panel 20.11 is affected by cross-site Scripting (XSS) to gain remote privileges. An attacker could compromise the security of a website or web application through a stored XSS attack and stealing cookies us…
▾ Sunlitdotcms · dotcmsEPSS 0.62%via NVD