CVE-2022-35147: Html-Js Doracms

Critical severity, CVSS 9.8. EPSS: 1.5% chance of exploitation in the next 30 days.

DoraCMS v2.18 and earlier allows attackers to bypass login authentication via a crafted HTTP request.

Affected products

• Html-Js Doracms: up to and including 2.1.8

Published 2022-08-17. Last modified 2026-06-17.