CVE-2016-2355

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

SQL injection vulnerability in the REST API in dotCMS before 3.3.2 allows remote attackers to execute arbitrary SQL commands via the stName parameter to api/content/save/1.

Metrics

CVSS 3.0 9.8/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-89

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://dotcms.com/security/SI-35Patch, Vendor Advisory
http://www.securityfocus.com/bid/94992
https://github.com/dotCMS/core/issues/8848Issue Tracking, Patch
http://dotcms.com/security/SI-35Patch, Vendor Advisory
http://www.securityfocus.com/bid/94992
https://github.com/dotCMS/core/issues/8848Issue Tracking, Patch

Timeline

Published: Dec 19, 2016
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2016

CVE-2016-23569.8Milesight IP security cameras through 2016-11-14 have a buffer overflow in a web application via a long username or password.CVE-2016-23579.8Milesight IP security cameras through 2016-11-14 have a hardcoded SSL private key under the /etc/config directory.CVE-2016-23589.8Milesight IP security cameras through 2016-11-14 have a default set of 10 privileged accounts with hardcoded credentials. They are accessibl CVE-2016-23599.8Milesight IP security cameras through 2016-11-14 allow remote attackers to bypass authentication and access a protected resource by simultan CVE-2016-23609.8Milesight IP security cameras through 2016-11-14 have a default root password in /etc/shadow that is the same across different customers' in CVE-2016-23629.8Fonality (previously trixbox Pro) 12.6 through 14.1i before 2016-06-01 has a hardcoded password for the FTP account, which allows remote att CVE-2016-23637.8Fonality (previously trixbox Pro) 12.6 through 14.1i before 2016-06-01 uses weak permissions for the /var/www/rpc/surun script, which allows CVE-2016-23647.5The Chrome HUDweb plugin before 2016-05-05 for Fonality (previously trixbox Pro) 12.6 through 14.1i uses the same hardcoded private key acro CVE-2016-23655.9A denial of service vulnerability exists in the handling of the MXIT protocol in Pidgin. Specially crafted MXIT data sent via the server cou CVE-2016-23665.9A denial of service vulnerability exists in the handling of the MXIT protocol in Pidgin. Specially crafted MXIT data sent via the server cou CVE-2016-23675.9An information leak exists in the handling of the MXIT protocol in Pidgin. Specially crafted MXIT data sent via the server could potentially CVE-2016-23688.1Multiple memory corruption vulnerabilities exist in the handling of the MXIT protocol in Pidgin. Specially crafted MXIT data sent via the se