Description
SQL injection vulnerability in the "Content Types > Content Types" screen in dotCMS before 3.7.2 and 4.x before 4.1.1 allows remote authenticated administrators to execute arbitrary SQL commands via the _EXT_STRUCTURE_direction parameter.
Remediation
References
Related Vulnerabilities
WordPress Plugin Diary & Availability Calendar SQL Injection (1.0.3)
Drupal Core 8.9.x Arbitrary File Overwrite (8.9.0 - 8.9.12)
MySQL CVE-2022-21427 Vulnerability (CVE-2022-21427)
phpMyAdmin Exposure of Sensitive Information to an Unauthorized Actor Vulnerability (CVE-2016-6612)
WordPress Plugin Dropdown Menu Widget Cross-Site Request Forgery (1.9.1)