CVE-2016-8907: SQL injection vulnerability in the "Content Types > Content Types" screen in dotCMS before 3.3.1 allows rem...

Security readout for executives and security teams

Older dotCMS installations before 3.3.1 have an authenticated SQL injection issue in the Content Types screen. A logged-in remote user could manipulate the orderby parameter to run arbitrary SQL against the database. Business risk depends on whether legacy dotCMS is still deployed and who can access that administrative content-management area. Exposure is most likely in legacy dotCMS deployments older than 3.3.1 where authenticated users can reach the Content Types management screen. Public internet exposure increases urgency, but the source bundle does not confirm anonymous exploitation or affected hosting models. Prioritize remediation if any business-critical or internet-accessible dotCMS instance is below 3.3.1. SQL injection can threaten data integrity and confidentiality, but exploitation requires authentication based on the provided sources. Mitigation focus: Upgrade dotCMS installations older than 3.3.1 after confirming vendor guidance.; Restrict access to Content Types administration to trusted CMS administrators.; Review database permissions used by dotCMS and limit unnecessary privileges..

Prepared

Jun 13, 2026, 13:16 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.