WaratekVRT Sign in
Reset
More filters (1)
Columns
Including CVEs outside Waratek scope✕Vendor dotcms✕
Overview 7 matches · 0 in Waratek scope · 0 protected · 1 exploited · 1 CISA KEV · 2 public PoC · 2 EPSS ≥ 0.5
7matches 0in Waratek scope0.0% 0protected0.0% 1exploited14.3% 1CISA KEV14.3% 2public PoC28.6% 2EPSS ≥ 0.528.6%
Protected by Waratek 0 0.0% Rule in development 0 0.0% Mitigation candidate 0 0.0% No exploit published 0 0.0% Outside Waratek scope 0 0.0% Not applicable 7 100.0% Withdrawn CVE 0 0.0%
Critical 7 100.0% High 0 0.0% Medium 0 0.0% Low 0 0.0% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 0 0.0% partly blocked 0 0.0% not blocked 7 100.0% not established 0 0.0% unrecorded 0 0.0%
Exploited 1 14.3% Working exploit published 1 14.3% Proof of concept only 0 0.0% Forecast only 1 14.3% No public exploit 4 57.1%
split by peak 2 / year
Not applicable: 7 Critical: 7 not blocked: 7 No public exploit: 4Forecast only: 1Working exploit published: 1Exploited: 1
20162 Not applicable2 Critical2 not blocked2 No public exploit2 20171 Not applicable1 Critical1 not blocked1 Working exploit published1 20180 20190 20201 Not applicable1 Critical1 not blocked1 Forecast only1 20211 Not applicable1 Critical1 not blocked1 No public exploit1 20221 Not applicable1 Critical1 not blocked1 Exploited1 20230 20240 20250 20261 Not applicable1 Critical1 not blocked1 No public exploit1
20162017201820192020202120222023202420252026
7 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.
CVE Severity Published▾ Status Exploitation Description
CVE-2025-11165 Critical 2026-02-24 Not applicable No public exploit A sandbox escape vulnerability exists in dotCMS’s Velocity scripting engine (VTools) that allows authenticated users with scripting privileges to bypass class and package restrictions enforced by SecureUberspectorImpl. By dynamically modifying the Velocity engine’s runtime configuration and reinitializing its Uberspect, a malicious actor can remove the introspector.restrict.classes and introspector.restrict.packages protections. Once these restrictions are cleared, the attacker can access arbitrary Java classes, including java.lang.Runtime, and execute arbitrary system commands under the privileges of the application process (e.g. dotCMS or Tomcat user).
CVE-2022-26352 Critical 2022-07-17 Not applicable Exploited An issue was discovered in the ContentResource API in dotCMS 3.0 through 22.02. Attackers can craft a multipart form request to post a file whose filename is not initially sanitized. This allows directory traversal, in which the file is saved outside of the intended storage location. If anonymous content creation is enabled, this allows an unauthenticated attacker to upload an executable file, such as a .jsp file, that can lead to remote code execution.
CVE-2020-19138 Critical 2021-09-08 Not applicable No public exploit Unrestricted Upload of File with Dangerous Type in DotCMS v5.2.3 and earlier allow remote attackers to execute arbitrary code via the component "/src/main/java/com/dotmarketing/filters/CMSFilter.java".
CVE-2020-6754 Critical 2020-02-05 Not applicable Forecast only dotCMS before 5.2.4 is vulnerable to directory traversal, leading to incorrect access control. It allows an attacker to read or execute files under $TOMCAT_HOME/webapps/ROOT/assets (which should be a protected directory). Additionally, attackers can upload temporary files (e.g., .jsp files) into /webapps/ROOT/assets/tmp_upload, which can lead to remote command execution (with the permissions of the user running the dotCMS application).
CVE-2017-5344 Critical 2017-02-17 Not applicable Working exploit published An issue was discovered in dotCMS through 3.6.1. The findChildrenByFilter() function which is called by the web accessible path /categoriesServlet performs string interpolation and direct SQL query execution. SQL quote escaping and a keyword blacklist were implemented in a new class, SQLUtil (main/java/com/dotmarketing/common/util/SQLUtil.java), as part of the remediation of CVE-2016-8902; however, these can be overcome in the case of the q and inode parameters to the /categoriesServlet path. Overcoming these controls permits a number of blind boolean SQL injection vectors in either parameter. The /categoriesServlet web path can be accessed remotely and without authentication in a default dotCMS deployment.
CVE-2016-2355 Critical 2016-12-19 Not applicable No public exploit SQL injection vulnerability in the REST API in dotCMS before 3.3.2 allows remote attackers to execute arbitrary SQL commands via the stName parameter to api/content/save/1.
CVE-2016-8902 Critical 2016-11-14 Not applicable No public exploit SQL injection vulnerability in the categoriesServlet servlet in dotCMS before 3.3.1 allows remote not authenticated attackers to execute arbitrary SQL commands via the sort parameter.