High
Security advisory
SQL injection vulnerability in the Workflow Screen in dotCMS before 3.3.2 allows remote administrators to execute arbitrary SQL commands via the orderby parameter.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2016-4040
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 31 Oct 2026, 12:09 UTC · Revision 1
Source evidence
SQL injection vulnerability in the Workflow Screen in dotCMS before 3.3.2 allows remote administrators to execute arbitrary SQL commands via the orderby parameter.
osv:CVE-2016-4040
Complete source record
{
"id": "9d8e6b70b95ca25cad505e4b1d5235989589f262c100119889822301bc149ef3",
"url": "https://osv.dev/vulnerability/CVE-2016-4040",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "CVE-2016-4040",
"summary": "SQL injection vulnerability in the Workflow Screen in dotCMS before 3.3.2 allows remote administrators to execute arbitrary SQL commands via the orderby parameter.",
"evidence": "osv:CVE-2016-4040",
"products": [],
"severity": "high",
"structured": {
"id": "CVE-2016-4040",
"aliases": [
"CVE-2016-4040"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/dotcms/core",
"type": "GIT",
"events": [
{
"introduced": "0"
},
{
"last_affected": "55f3f10337ebebf74c22ac82a411c4af276c6b09"
},
{
"fixed": "bc4db5d71dc67015572f8e4c6fdf87e29b854d02"
}
],
"database_specific": {
"extracted_events": [
{
"cpe": "cpe:2.3:a:dotcms:dotcms:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "0"
},
{
"last_affected": "3.3.1"
}
],
"source": "CPE_RANGE"
},
{
"range": [
{
"fixed": "bc4db5d71dc67015572f8e4c6fdf87e29b854d02"
}
],
"source": "REFERENCES_COMMIT"
}
]
}
}
],
"versions": [
"3.3.1",
"3.3",
"3.5_Preview02",
"3.5_Preview01",
"pre3.5buildrevert",
"3.2.1",
"3.2",
"3.0"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2016-4040.json",
"vanir_signatures": [
{
"id": "CVE-2016-4040-26d5e3a3",
"digest": {
"length": 902,
"function_hash": "146553412463661694529665155956298200977"
},
"source": "https://github.com/dotcms/core/commit/bc4db5d71dc67015572f8e4c6fdf87e29b854d02",
"target": {
"file": "src/com/dotmarketing/portlets/workflows/model/WorkflowSearcher.java",
"function": "WorkflowSearcher"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2016-4040-5f779027",
"digest": {
"threshold": 0.9,
"line_hashes": [
"168548086562533713783805126038546190139",
"45393739089889810706477200054240485474",
"49667685965912731254771251782507568244"
]
},
"source": "https://github.com/dotcms/core/commit/bc4db5d71dc67015572f8e4c6fdf87e29b854d02",
"target": {
"file": "src/com/dotmarketing/factories/EmailFactory.java"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2016-4040-72fc4a84",
"digest": {
"threshold": 0.9,
"line_hashes": [
"183110635773772962403820442937360175254",
"109398318881901452971784643168045281612",
"88540287413814294498137852660443171517",
"155034379425858125024455644027391605368",
"135506950140576638110624424402855858996",
"133160561274209008444879932633734323434",
"120496209273316070342038657811520055497",
"85443978690946867411732431428255038325",
"19992149743797101135100577514139435588",
"127958600653692894327406137188774956745",
"95985371943781611890276119361519373811",
"148862143083758759146610132129283791538",
"191798460094123393394033478898197378544",
"158202531139467800518846169706354333925",
"166747397672484010138772718834442634359",
"109841636642039664459818389343207290787"
]
},
"source": "https://github.com/dotcms/core/commit/bc4db5d71dc67015572f8e4c6fdf87e29b854d02",
"target": {
"file": "src/com/dotmarketing/portlets/workflows/model/WorkflowSearcher.java"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2016-4040-c563e73a",
"digest": {
"length": 39,
"function_hash": "176800501469594472534976216634135012135"
},
"source": "https://github.com/dotcms/core/commit/bc4db5d71dc67015572f8e4c6fdf87e29b854d02",
"target": {
"file": "src/com/dotmarketing/portlets/workflows/model/WorkflowSearcher.java",
"function": "getOrderBy"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2016-4040-dd723b7e",
"digest": {
"length": 7446,
"function_hash": "293721798236642630076371622678211121054"
},
"source": "https://github.com/dotcms/core/commit/bc4db5d71dc67015572f8e4c6fdf87e29b854d02",
"target": {
"file": "src/com/dotmarketing/factories/EmailFactory.java",
"function": "sendParameterizedEmail"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2016-4040-ec7dd845",
"digest": {
"threshold": 0.9,
"line_hashes": [
"120760799192413248715899379604117319749",
"243884907574043380725466628929912262363",
"264411183942065243064873136232911912113",
"141689773236307926928748816832140005811"
]
},
"source": "https://github.com/dotcms/core/commit/bc4db5d71dc67015572f8e4c6fdf87e29b854d02",
"target": {
"file": "src/com/dotmarketing/cms/webforms/action/SubmitWebFormAction.java"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2016-4040-f24a06d3",
"digest": {
"length": 5698,
"function_hash": "186321998741370624673172654221131130721"
},
"source": "https://github.com/dotcms/core/commit/bc4db5d71dc67015572f8e4c6fdf87e29b854d02",
"target": {
"file": "src/com/dotmarketing/cms/webforms/action/SubmitWebFormAction.java",
"function": "unspecified"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
}
],
"vanir_signatures_modified": "2026-10-20T13:12:44Z"
}
}
],
"modified": "2026-10-20T13:12:44.281354657Z",
"provider": "osv",
"references": [
"https://github.com/dotCMS/core/issues/8840",
"https://github.com/dotCMS/core/commit/bc4db5d71dc67015572f8e4c6fdf87e29b854d02"
],
"provider_metadata": {}
},
"related_cves": [
{
"value": "CVE-2016-4040",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 387304,
"published_at": "2016-04-19T14:59:03.953+00:00"
}