High severity7.2OSV Advisory· Published Feb 19, 2018· Updated Jun 17, 2026

CVE-2016-10007

Description

SQL injection vulnerability in the "Marketing > Forms" screen in dotCMS before 3.7.2 and 4.x before 4.1.1 allows remote authenticated administrators to execute arbitrary SQL commands via the _EXT_FORM_HANDLER_orderBy parameter.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Dotcms/CoreOSV
Range: 3.0, 3.5, 3.5_Preview01, …
Dotcms/Dotcmsllm-fuzzy
Range: <3.7.2, <4.1.1

Patches

Vulnerability mechanics

References

security.elarlang.eu/cve-2016-10007-and-cve-2016-10008-2-sql-injection-vulnerabilities-in-dotcms-blacklist-defence-bypass.htmlnvdExploitThird Party Advisory

News mentions

No linked articles in our index yet.

cvss	0.468
epss	0.001
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000