Sploitus

46 exploited vulnerabilities in Dotcms

Vulnerabilities with publicly known exploits

Vendors
Dotcms, Git, Apache
With known exploits
46
Affected Dotcms versions
≤ 22.02, 3.6.1, 3.3, 3.2.1, 3.3.1, 3.7.2, 4.1.1, 5.1.1

Vulnerabilities with exploits

Highest CVSS first — 17 of these already have exploit code on Sploitus

CVE-2022-26352 3 exploits
CVSS 10.0 CRITICAL 2022-03-28
dotCMS Shell Upload ExploitdotCMS Shell Upload
CVE-2020-19138
CVSS 10.0 CRITICAL 2021-09-08
CVE-2025-11165
CVSS 9.9 CRITICAL 2026-02-24
CVE-2020-6754
CVSS 9.8 CRITICAL 2020-02-05FIX AVAILABLE
CVE-2017-5344 5 exploits
CVSS 9.8 CRITICAL 2017-02-17FIX AVAILABLE
dotCMS 3.6.1 Blind Boolean SQL Injection VulnerabilitydotCMS Blind Boolean SQL Injection in dotCMS <= 3.6.1 (CVE-2017-5344)
CVE-2016-8902 2 exploits
CVSS 9.8 CRITICAL 2016-11-14FIX AVAILABLE
dotCMS 3.x SQL Injection VulnerabilitydotCMS 3.x SQL Injection
CVE-2026-16337
CVSS 9.4 CRITICAL 2026-07-20FIX AVAILABLE
CVE-2025-8311 4 exploits
CVSS 9.4 CRITICAL 2025-09-04FIX AVAILABLE
📄 dotCMS 25.07.02-1 Security Scanner📄 dotCMS 25.07.02-1 SQL Injection
CVE-2017-11466
CVSS 9.0 HIGH 2017-07-20FIX AVAILABLE
CVE-2022-45782
CVSS 8.8 HIGH 2023-02-01FIX AVAILABLE
CVE-2020-27848
CVSS 8.8 HIGH 2020-12-30FIX AVAILABLE
CVE-2016-8908 2 exploits
CVSS 8.8 HIGH 2016-11-14FIX AVAILABLE
dotCMS 3.x SQL Injection VulnerabilitydotCMS 3.x SQL Injection
CVE-2016-8907 2 exploits
CVSS 8.8 HIGH 2016-11-14FIX AVAILABLE
dotCMS 3.x SQL Injection VulnerabilitydotCMS 3.x SQL Injection
CVE-2016-8906 2 exploits
CVSS 8.8 HIGH 2016-11-14FIX AVAILABLE
dotCMS 3.x SQL Injection VulnerabilitydotCMS 3.x SQL Injection
CVE-2016-8905 2 exploits
CVSS 8.8 HIGH 2016-11-14FIX AVAILABLE
dotCMS 3.x SQL Injection VulnerabilitydotCMS 3.x SQL Injection
CVE-2016-8904 2 exploits
CVSS 8.8 HIGH 2016-11-14FIX AVAILABLE
dotCMS 3.x SQL Injection VulnerabilitydotCMS 3.x SQL Injection
CVE-2016-8903 2 exploits
CVSS 8.8 HIGH 2016-11-14FIX AVAILABLE
dotCMS 3.x SQL Injection VulnerabilitydotCMS 3.x SQL Injection
CVE-2016-8600 1 exploit
CVSS 7.5 HIGH 2016-10-28FIX AVAILABLE
dotCMS CAPTCHA Bypass Vulnerability
CVE-2016-4803 1 exploit
CVSS 7.5 HIGH 2016-06-30FIX AVAILABLE
dotCMS Email Header Injection
CVE-2016-10008 1 exploit
CVSS 7.2 HIGH 2018-02-19FIX AVAILABLE
dotCMS SQL Injection
CVE-2016-10007 1 exploit
CVSS 7.2 HIGH 2018-02-19FIX AVAILABLE
dotCMS SQL Injection
CVE-2022-45783
CVSS 6.5 MEDIUM 2023-02-01
CVE-2022-37033
CVSS 6.5 MEDIUM 2023-02-01
CVE-2016-3688 1 exploit
CVSS 6.5 MEDIUM 2016-04-19FIX AVAILABLE
DotCMS 3.3 SQL Injection
CVE-2022-35740
CVSS 6.1 MEDIUM 2022-11-10FIX AVAILABLE
CVE-2019-11846 4 exploits
CVSS 6.1 MEDIUM 2019-05-11
dotCMS 5.1.1 - HTML Injection VulnerabilitydotCMS 5.1.1 - HTML Injection
CVE-2018-17422
CVSS 6.1 MEDIUM 2019-03-07FIX AVAILABLE
CVE-2018-16980
CVSS 6.1 MEDIUM 2018-09-12FIX AVAILABLE
CVE-2017-5877
CVSS 6.1 MEDIUM 2017-02-06FIX AVAILABLE
CVE-2017-5876
CVSS 6.1 MEDIUM 2017-02-06FIX AVAILABLE
CVE-2020-17542
CVSS 5.4 MEDIUM 2021-04-23FIX AVAILABLE
CVE-2018-19554
CVSS 5.4 MEDIUM 2018-11-26FIX AVAILABLE
CVE-2017-5875
CVSS 5.4 MEDIUM 2017-02-06FIX AVAILABLE
CVE-2017-15219
CVSS 5.4 MEDIUM 2017-10-10
CVE-2023-3042
CVSS 5.3 MEDIUM 2023-10-17FIX AVAILABLE
CVE-2022-37034
CVSS 5.3 MEDIUM 2023-02-01
CVE-2021-35361
CVSS 4.8 MEDIUM 2021-07-09
CVE-2021-35360
CVSS 4.8 MEDIUM 2021-07-09
CVE-2021-35358
CVSS 4.8 MEDIUM 2021-07-09
CVE-2020-35274
CVSS 4.8 MEDIUM 2020-12-21FIX AVAILABLE
CVE-2016-3971
CVSS 4.8 MEDIUM 2016-04-18FIX AVAILABLE
CVE-2024-3165
CVSS 4.5 MEDIUM 2024-04-01
CVE-2024-3164
CVSS 4.5 MEDIUM 2024-04-01FIX AVAILABLE
CVE-2013-3484
CVSS 4.3 MEDIUM 2014-04-02FIX AVAILABLE
CVE-2008-3708 1 exploit
CVSS 4.3 MEDIUM 2008-08-19FIX AVAILABLE
dotCMS 1.6 - 'id' Local File Inclusion
CVE-2016-3972
CVSS 4.0 MEDIUM 2016-04-18FIX AVAILABLE