Description
SQL injection vulnerability in the "Marketing > Forms" screen in dotCMS before 3.7.2 and 4.x before 4.1.1 allows remote authenticated administrators to execute arbitrary SQL commands via the _EXT_FORM_HANDLER_orderBy parameter.
Remediation
References
Related Vulnerabilities
Jetty Exposure of Sensitive Information to an Unauthorized Actor Vulnerability (CVE-2021-34429)
WordPress Plugin WebARX Cross-Site Scripting (1.3.0)
SugarCRM Improper Control of Generation of Code ('Code Injection') Vulnerability (CVE-2019-17310)
WordPress 5.2.x Multiple Vulnerabilities (5.2 - 5.2.9)
Jenkins Protection Mechanism Failure Vulnerability (CVE-2021-21696 )