CVE-2019-12872: dotCMS

High severity, CVSS 7.2. EPSS: 1.3% chance of exploitation in the next 30 days.

dotCMS before 5.1.6 is vulnerable to a SQL injection that can be exploited by an attacker of the role Publisher via view_unpushed_bundles.jsp.

Affected products

• dotCMS dotCMS: before 5.1.6 (fixed in 5.1.6)

Published 2019-06-18. Last modified 2026-06-17.