CVE-2017-5876: XSS was discovered in dotCMS 3.7.0, with an unauthenticated attack against the /news-events/events date par...

Security readout for executives and security teams

CVE-2017-5876 describes cross-site scripting in dotCMS 3.7.0 through the public /news-events/events date parameter. An unauthenticated attacker could target users’ browsers through that page. The bundle provides no CVSS score, no confirmed fixed version, and no evidence of active exploitation. Likely exposure is limited to organizations running dotCMS 3.7.0 with the /news-events/events route reachable. The source bundle lists affected product fields as n/a, so do not assume other versions or products without vendor confirmation. Treat this as a targeted review item, not a confirmed emergency. If dotCMS 3.7.0 is internet-facing, assign near-term remediation ownership because browser-side attacks can affect users and administrators. Mitigation focus: Inventory any dotCMS 3.7.0 deployments and exposed event pages.; Check dotCMS vendor guidance or issue history for fixed versions.; Prioritize vendor-supported upgrade or remediation once confirmed..

Prepared

Jun 13, 2026, 06:20 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.