dotCMS Core

Every one of the 6 is a mark on the map. Named now: 1 to 6, most at risk first.

1. dotCMS Core Publish Audit API - Unauthenticated SQL InjectionCVE-2026-8054dotCMS · CVSS 10 · 1.6% likely

   CWE-89

2. Database Credential Exposure in the LogsCVE-2024-3165dotCMS · CVSS 4.5 · 0.5% likely

   CWE-532

3. In the System → Maintenance tool, the Logged Users tab surfaces sessionId data for all users via the Direct Web Remoting API (UserSessionAjax.getSessionList.dwr) calls. While this…CVE-2024-4447dotCMS · CVSS 9.9 · 0.5% likely

   CWE-863

4. In dotCMS dashboard, the Tools and Log Files tabs under System → Maintenance Portlet, which is and always has been an Admin portlet, is accessible to anyone with that portlet and…CVE-2024-3164dotCMS · CVSS 4.5 · 0.5% likely

   CWE-284

5. CNA SHORTNAME: dotCMSORG UUID: 5b9d93f2-25c7-46b4-ab60-d201718c9dd8CVE-2023-3042dotCMS · CVSS 5.3 · 0.4% likely

   CWE-79

6. The "reset password" login page accepted an HTML injection via URL parameters. This has already been rectified via patch, and as such it cannot be demonstrated via Demo site link.…CVE-2024-3938dotCMS · CVSS 5.4 · 0.3% likely

   CWE-20

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.