What’s Vulnerable › Vulnerabilities

CVE-2012-1826

• Severity: medium (CVSS 6.0 v2.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 2.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2012-06-08 · updated 2026-06-16
• Weakness: CWE-264

Description

dotCMS 1.9 before 1.9.5.1 allows remote authenticated users to execute arbitrary Java code via a crafted (1) XSLT or (2) Velocity template.

Affected products

• dotCMS core: 1.9, 1.9.2.1

References

• http://dotcms.com/dotCMSVersions/
• http://osvdb.org/82240
• http://secunia.com/advisories/49276
• http://www.kb.cert.org/vuls/id/898083
• http://www.securityfocus.com/bid/53688
• https://gist.github.com/2627440
• https://github.com/dotCMS/dotCMS/issues/261
• https://github.com/dotCMS/dotCMS/issues/281
• http://dotcms.com/dotCMSVersions/
• http://osvdb.org/82240
• http://secunia.com/advisories/49276
• http://www.kb.cert.org/vuls/id/898083

Get alerted when CVE-2012-1826 or the next vulnerability affects your stack