CVE-2016-2355: dotCMS

Critical severity, CVSS 9.8. EPSS: 2.1% chance of exploitation in the next 30 days.

SQL injection vulnerability in the REST API in dotCMS before 3.3.2 allows remote attackers to execute arbitrary SQL commands via the stName parameter to api/content/save/1.

Affected products

• dotCMS dotCMS: up to and including 3.3.1

Published 2016-12-19. Last modified 2026-06-17.