CVE-2020-27848

dotCMS before 20.10.1 allows SQL injection, as demonstrated by the /api/v1/containers orderby parameter. The PaginatorOrdered classes that are used to paginate results of a REST endpoints do not sanitize the orderBy parameter and in some cases it is vulnerable to SQL injection attacks. A user must be an authenticated manager in the dotCMS system to exploit this vulnerability.

• CWE-89

• https://github.com/dotCMS/core/compare/v5.3.8.1...v20.10.1Patch, Third Party Advisory
• https://github.com/dotCMS/core/issues/19500Exploit, Third Party Advisory
• https://github.com/dotCMS/core/compare/v5.3.8.1...v20.10.1Patch, Third Party Advisory
• https://github.com/dotCMS/core/issues/19500Exploit, Third Party Advisory

Published

Dec 30, 2020

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-27842There's a flaw in openjpeg's t2 encoder in versions prior to…5.5
• CVE-2020-27843A flaw was found in OpenJPEG in versions prior to 2.4.0. Thi…5.5
• CVE-2020-27844A flaw was found in openjpeg's src/lib/openjp2/t2.c in versi…7.8
• CVE-2020-27845There's a flaw in src/lib/openjp2/pi.c of openjpeg in versio…5.5
• CVE-2020-27846A signature verification vulnerability exists in crewjam/sam…9.8
• CVE-2020-27847A vulnerability exists in the SAML connector of the github.c…9.8
• CVE-2020-2785Vulnerability in the Oracle Outside In Technology product of…7.3
• CVE-2020-27850A stored Cross-Site Scripting (XSS) vulnerability in forms i…4.8
• CVE-2020-27851Multiple stored HTML injection vulnerabilities in the "poll"…5.4
• CVE-2020-27852A stored Cross-Site Scripting (XSS) vulnerability in the sur…5.4
• CVE-2020-27853Wire before 2020-10-16 allows remote attackers to cause a de…9.8
• CVE-2020-27855This vulnerability allows remote attackers to disclose sensi…7.8