CVE-2016-8902

· N/AModified

← All CVEs

CVSS v3.1

N/A

EPSS

2.75%

Published

Nov 14, 2016

Modified

May 6, 2026

Public PoC / Exploit (1)

All weaponized →

TrickestTrickest PoC index

Links to public security research (Exploit-DB, Nuclei, Trickest, GitHub) for defensive use only.

Description

SQL injection vulnerability in the categoriesServlet servlet in dotCMS before 3.3.1 allows remote not authenticated attackers to execute arbitrary SQL commands via the sort parameter.

Weaknesses (CWE)

CWE-89

Affected Products (1)

dotcms · dotcmsvulnerable

References (10)

http://seclists.org/fulldisclosure/2016/Nov/0

Third Party Advisory

http://www.securityfocus.com/bid/94311

Technical DescriptionVDB Entry

https://github.com/dotCMS/core/pull/8460/

PatchVendor Advisory

https://github.com/dotCMS/core/pull/8468/

PatchVendor Advisory

https://security.elarlang.eu/multiple-sql-injection-vulnerabilities-in-dotcms-8x-cve-full-disclosure.html

ExploitThird Party Advisory

http://seclists.org/fulldisclosure/2016/Nov/0

Third Party Advisory

http://www.securityfocus.com/bid/94311

Technical DescriptionVDB Entry

https://github.com/dotCMS/core/pull/8460/

PatchVendor Advisory

https://github.com/dotCMS/core/pull/8468/

PatchVendor Advisory

https://security.elarlang.eu/multiple-sql-injection-vulnerabilities-in-dotcms-8x-cve-full-disclosure.html

ExploitThird Party Advisory

KEV Catalog EPSS Scores Vendors All CVEs