CVE-2012-5701: Multiple SQL injection vulnerabilities in dotProject before 2.1.7 allow remote authenticated administrators...

Security readout for executives and security teams

CVE-2012-5701 affects dotProject versions before 2.1.7. It could let an administrator-level session, or a victimed administrator through CSRF, cause the application to run unintended database commands. This is mainly urgent for organizations still operating legacy dotProject instances. Exposure is limited to dotProject deployments before 2.1.7. Risk is higher where administrator sessions are reachable from untrusted networks, where CSRF defenses are weak, or where the application database holds sensitive project, contact, or operational data. Prioritize if dotProject is still in use, especially for internet-accessible or business-critical deployments. This is an old issue with unclear severity scoring, but arbitrary SQL against project-management data can create confidentiality, integrity, and operational risk. Mitigation focus: Inventory all dotProject installations and identify versions before 2.1.7.; Review vendor or project guidance before applying changes.; Upgrade affected dotProject deployments to 2.1.7 or a supported replacement..

Prepared

Jun 14, 2026, 06:22 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.