CVSS: 7.2EPSS: 0%CPEs: 2EXPL: 1CVE-2016-10007 – dotCMS SQL Injection
https://notcve.org/view.php?id=CVE-2016-10007
SQL injection vulnerability in the "Marketing > Forms" screen in dotCMS before 3.7.2 and 4.x before 4.1.1 allows remote authenticated administrators to execute arbitrary SQL commands via the _EXT_FORM_HANDLER_orderBy parameter. Vulnerabilidad de inyección SQL en la pantalla "Marketing > Forms" en dotCMS en versiones anteriores a la 3.7.2 y 4.x anteriores a la 4.1.1 permite que los administradores autenticados remotos ejecuten comandos SQL arbitrarios mediante el parámetro _EXT_FORM_HANDLER_orderBy. dotCMS versions prior to 4.1.1 suffer from remote SQL injection vulnerabilities. • https://security.elarlang.eu/cve-2016-10007-and-cve-2016-10008-2-sql-injection-vulnerabilities-in-dotcms-blacklist-defence-bypass.html • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 7.2EPSS: 0%CPEs: 2EXPL: 1CVE-2016-10008 – dotCMS SQL Injection
https://notcve.org/view.php?id=CVE-2016-10008
SQL injection vulnerability in the "Content Types > Content Types" screen in dotCMS before 3.7.2 and 4.x before 4.1.1 allows remote authenticated administrators to execute arbitrary SQL commands via the _EXT_STRUCTURE_direction parameter. Vulnerabilidad de inyección SQL en la pantalla "Content Types > Content Types" en dotCMS en versiones anteriores a la 3.7.2 y 4.x anteriores a la 4.1.1 permite que los administradores autenticados remotos ejecuten comandos SQL arbitrarios mediante el parámetro _EXT_STRUCTURE_direction. dotCMS versions prior to 4.1.1 suffer from remote SQL injection vulnerabilities. • https://security.elarlang.eu/cve-2016-10007-and-cve-2016-10008-2-sql-injection-vulnerabilities-in-dotcms-blacklist-defence-bypass.html • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 0CVE-2017-6003
https://notcve.org/view.php?id=CVE-2017-6003
dotCMS 3.7.0 has XSS reachable from ext/languages_manager/edit_language in portal/layout via the bottom two form fields. dotCMS 3.7.0 tiene XSS accesible desde ext/languages_manager/edit_language en portal/layout a través de los dos campos de formulario inferiores. • http://www.securityfocus.com/bid/97089 http://www.yiwang6.cn/dotcms.docx • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.4EPSS: 0%CPEs: 1EXPL: 1CVE-2017-5875
https://notcve.org/view.php?id=CVE-2017-5875
XSS was discovered in dotCMS 3.7.0, with an authenticated attack against the /myAccount addressID parameter. XSS fue descubierto en dotCMS 3.7.0, con un ataque autenticado contra el parámetro /myAccount addressID. • http://www.securityfocus.com/bid/96115 https://github.com/dotCMS/core/issues/10643 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 1CVE-2017-5877
https://notcve.org/view.php?id=CVE-2017-5877
XSS was discovered in dotCMS 3.7.0, with an unauthenticated attack against the /about-us/locations/index direction parameter. XSS fue descubierto en dotCMS 3.7.0, con un ataque no autenticado contra el parámetro /about-us/locations/index direction. • http://www.securityfocus.com/bid/96115 https://github.com/dotCMS/core/issues/10643 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •