SQL Injection

Every one of the 17 is a mark on the map. Named now: 1 to 17, most at risk first.

1. dotCMS Core Publish Audit API - Unauthenticated SQL InjectionCVE-2026-8054dotCMS · CVSS 10 · 1.6% likely

   CWE-89

2. An issue was discovered in dotCMS through 3.6.1. The findChildrenByFilter() function which is called by the web accessible path /categoriesServlet performs string interpolation an…CVE-2017-5344Dotcms · 6.3% likely

   CWE-89

3. SQL injection vulnerability in the categoriesServlet servlet in dotCMS before 3.3.1 allows remote not authenticated attackers to execute arbitrary SQL commands via the sort parame…CVE-2016-8902Dotcms · 2.8% likely

   CWE-89

4. SQL injection vulnerability in the REST API in dotCMS before 3.3.2 allows remote attackers to execute arbitrary SQL commands via the stName parameter to api/content/save/1.CVE-2016-2355Dotcms · 2.1% likely

   CWE-89

5. SQL injection vulnerability in the "Site Browser > HTML pages" screen in dotCMS before 3.3.1 allows remote authenticated attackers to execute arbitrary SQL commands via the orderb…CVE-2016-8908Dotcms · 2.0% likely

   CWE-89

6. SQL injection vulnerability in the "Content Types > Content Types" screen in dotCMS before 3.3.1 allows remote authenticated attackers to execute arbitrary SQL commands via the or…CVE-2016-8907Dotcms · 2.0% likely

   CWE-89

7. SQL injection vulnerability in the "Site Browser > Links pages" screen in dotCMS before 3.3.1 allows remote authenticated attackers to execute arbitrary SQL commands via the order…CVE-2016-8906Dotcms · 2.0% likely

   CWE-89

8. SQL injection vulnerability in the JSONTags servlet in dotCMS before 3.3.1 allows remote authenticated attackers to execute arbitrary SQL commands via the sort parameter.CVE-2016-8905Dotcms · 2.0% likely

   CWE-89

9. SQL injection vulnerability in the "Site Browser > Containers pages" screen in dotCMS before 3.3.1 allows remote authenticated attackers to execute arbitrary SQL commands via the…CVE-2016-8904Dotcms · 1.9% likely

   CWE-89

10. SQL injection vulnerability in the "Site Browser > Templates pages" screen in dotCMS before 3.3.1 allows remote authenticated attackers to execute arbitrary SQL commands via the o…CVE-2016-8903Dotcms · 1.9% likely

    CWE-89

11. dotCMS versions 24.03.22 and after, identified a Boolean-based blind SQLi vulnerability in the /api/v1/contenttype endpoint. This endpoint uses the sites query parameter, which ac…CVE-2025-8311dotCMS · CVSS 9.4 · 1.7% likely

    CWE-89

12. SQL injection vulnerability in the Workflow Screen in dotCMS before 3.3.2 allows remote administrators to execute arbitrary SQL commands via the orderby parameter.CVE-2016-4040Dotcms · 1.3% likely

    CWE-89

13. SQL injection vulnerability in the "Content Types > Content Types" screen in dotCMS before 3.7.2 and 4.x before 4.1.1 allows remote authenticated administrators to execute arbitra…CVE-2016-10008Dotcms · 1.3% likely

    CWE-89

14. SQL injection vulnerability in the "Marketing > Forms" screen in dotCMS before 3.7.2 and 4.x before 4.1.1 allows remote authenticated administrators to execute arbitrary SQL comma…CVE-2016-10007Dotcms · 1.3% likely

    CWE-89

15. dotCMS before 5.1.6 is vulnerable to a SQL injection that can be exploited by an attacker of the role Publisher via view_unpushed_bundles.jsp.CVE-2019-12872Dotcms · 1.3% likely

    CWE-89

16. dotCMS before 20.10.1 allows SQL injection, as demonstrated by the /api/v1/containers orderby parameter. The PaginatorOrdered classes that are used to paginate results of a REST e…CVE-2020-27848Dotcms · 1.2% likely

    CWE-89

17. A sandbox escape vulnerability exists in dotCMS’s Velocity scripting engine (VTools) that allows authenticated users with scripting privileges to bypass class and package restrict…CVE-2025-11165dotCMS · CVSS 9.4 · 0.3% likely

    CWE-89

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.