Exploitation ongoing with high activity in latest observed window (1 mentions)
Recommended action window: Immediate (within 24h)
NVD description
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in the Publish Audit API endpoints (/api/auditPublishing/get and /api/auditPublishing/getAll) in dotCMS Core 25.11.04-1 through 26.04.28-02 allows remote unauthenticated attackers to read, modify, or destroy arbitrary database content. The endpoints did not enforce authentication and accepted unsanitized input used in dynamically constructed SQL. The fix in dotCMS Core 26.04.28-03 requires an authenticated backend user with the publishing-queue portlet permission. LTS releases are not affected as the vulnerable code path was never backported.
Priority
MEDIUM
Exploitation
ACTIVE
PoC
YES
Patch
AVAILABLE
Momentum
STABLE
| Date | Total | Labels |
|---|
| 2026-05-28 | 1 | Disclosure1 |
| 2026-06-08 | 2 | General1PoC1 |
| 2026-06-09 | 1 | Disclosure1 |
| 2026-06-10 | 1 | Patch1 |
| 2026-06-11 | 1 | General1 |
| 2026-06-27 | 1 | Active Exploitation1 |
CVE-2026-8054 DotCMS pre auth SQL Injection https://t.co/dOZFsnoZTY
Post summary
The tweet announces a pre-authentication SQL injection vulnerability (CVE-2026-8054) in DotCMS but provides no additional technical details, exploit code, patch information, or evidence of active exploitation.
#CVE-2026-8054: #dotCMS Core SQL Injection Based on internet-wide exposure data in Shadon, many organizations appear to be running #dotCMS instances. Users are strongly encouraged to upgrade and patch affected systems immediately. https://t.co/mEfnNaoGEF
Post summary
The tweet announces a SQL injection vulnerability in dotCMS (CVE-2026-8054) and urges users to patch or upgrade immediately.
New private PoC added for CVE-2026-8054. Unauthenticated SQL Injection in the dotCMS Publish Audit API. Affected endpoints: POST /api/auditPublishing/getAll POST /api/auditPublishing/get Affected versions: dotCMS Core 25.11.04-1 through 26.04.28-02 Fixed: 26.04.28-03 26.05.06-01+ LTS releases are not affected. We have not yet observed exploitation against KEVIntel honeypots, but with a private PoC now available, exploitation attempts are likely only a matter of time. Available now for KEVIntel Pro users: https://kevintel.com/CVE-2026-8054
Post summary
A private PoC for CVE-2026-8054, an unauthenticated SQL injection in dotCMS’s Publish Audit API, is now available along with patch information; exploitation has not yet been observed.
🚨 We observed dotCMS CVE-2026-8054 exploitation in the wild this morning. Unauthenticated SQL injection in the dotCMS Publish Audit API. Now added to the KEVIntel KEV feed. • CVSS 10 • Remote • Low complexity • No user interaction • Not yet in CISA KEV One to move up the queue.
Post summary
dotCMS CVE-2026-8054, an unauthenticated SQL injection, was observed being exploited in the wild with high severity (CVSS 10); no patch or PoC details were provided, but it has been added to the KEVIntel feed.
🚨 CVE-2026-8054 - critical 🚨 dotCMS Core Publish Audit API - Unauthenticated SQL Injection > dotCMS Core 25.11.04-1 through 26.04.28-02 contains an SQL injection caused by unsani... 👾 https://cloud.projectdiscovery.io/library/CVE-2026-8054 @pdnuclei #NucleiTemplates #cve
Post summary
The tweet announces the critical CVE-2026‑8054, indicating an unauthenticated SQL injection in dotCMS Core 25.11.04‑1 through 26.04.28‑02, and links to a ProjectDiscovery library entry that likely contains detection or PoC material.
Top 5 Trending CVEs: 1 - CVE-2025-8088 2 - CVE-2026-49980 3 - CVE-2025-49604 4 - CVE-2026-42897 5 - CVE-2026-8054 #cve #cvetrends #cveshield #cybersecurity https://www.cveshield.com/dashboard
Post summary
The post lists five trending CVEs without offering PoCs, exploits, active-use claims, patches, or technical details.
『The endpoint requires no authentication, enabling an unauthenticated remote attacker to read, modify, or destroy the entire dotCMS PostgreSQL database with a single HTTP request.』 CVE-2026-8054 — dotCMS Core Publish Audit API SQL Injection https://aretiq.ai/research/vul260527-cve-2026-8054-dotcms-core-publish-audit-api-sql-injection/
Post summary
The text announces CVE-2026-8054, a SQL injection flaw in dotCMS allowing unauthenticated attackers to fully compromise the PostgreSQL database, and provides a link to research that likely includes PoC details.