CVE-2016-8904

8.8 highEPSS 1.9%

SQL injection vulnerability in the "Site Browser > Containers pages" screen in dotCMS before 3.3.1 allows remote authenticated attackers to execute arbitrary SQL commands via the orderby parameter.

Severity

CVSS 3.0

8.8 high

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS: 1.9% chance of exploitation in the next 30 days; higher than 80% of CVEs (scores of 2026-10-31)
CWE: CWE-89
Published: 2016-11-14
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

dotcms:dotcms

References

http://seclists.org/fulldisclosure/2016/Nov/0
http://www.securityfocus.com/bid/94311
https://github.com/dotCMS/core/pull/8460/
https://github.com/dotCMS/core/pull/8468/
https://security.elarlang.eu/multiple-sql-injection-vulnerabilities-in-dotcms-8x-cve-full-disclosure.html

Check your stack JSON