CVE-2016-3688: dotCMS

Medium severity, CVSS 6.5. EPSS: 1.6% chance of exploitation in the next 30 days.

SQL injection vulnerability in dotCMS before 3.5 allows remote administrators to execute arbitrary SQL commands via the c0-e3 parameter to dwr/call/plaincall/UserAjax.getUsersList.dwr.

Affected products

• dotCMS dotCMS: up to and including 3.3.1

Published 2016-04-19. Last modified 2026-06-17.