Show filters
9 Total Results
Displaying 1-9 of 9
Sort by:
Attacker Value
Unknown
CVE-2018-5690
Disclosure Date: January 14, 2018 (last updated November 26, 2024)
Cross-site scripting (XSS) vulnerability in admin/users.php in Dotclear 2.12.1 allows remote authenticated users to inject arbitrary web script or HTML via the nb parameter (aka the page limit number).
0
Attacker Value
Unknown
CVE-2018-5689
Disclosure Date: January 14, 2018 (last updated November 26, 2024)
Cross-site scripting (XSS) vulnerability in admin/auth.php in Dotclear 2.12.1 allows remote authenticated users to inject arbitrary web script or HTML via the malicious user's email.
0
Attacker Value
Unknown
CVE-2017-6446
Disclosure Date: March 05, 2017 (last updated November 26, 2024)
XSS was discovered in Dotclear v2.11.2, affecting admin/blogs.php and admin/users.php with the sortby and order parameters.
0
Attacker Value
Unknown
CVE-2014-5316
Disclosure Date: September 22, 2014 (last updated October 05, 2023)
Cross-site scripting (XSS) vulnerability in Dotclear before 2.6.4 allows remote attackers to inject arbitrary web script or HTML via a crafted page.
0
Attacker Value
Unknown
CVE-2014-3783
Disclosure Date: May 22, 2014 (last updated October 05, 2023)
SQL injection vulnerability in admin/categories.php in Dotclear before 2.6.3 allows remote authenticated users with the manage categories permission to execute arbitrary SQL commands via the categories_order parameter.
0
Attacker Value
Unknown
CVE-2014-1613
Disclosure Date: May 16, 2014 (last updated October 05, 2023)
Dotclear before 2.6.2 allows remote attackers to execute arbitrary PHP code via a serialized object in the dc_passwd cookie to a password-protected page, which is not properly handled by (1) inc/public/lib.urlhandlers.php or (2) plugins/pages/_public.php.
0
Attacker Value
Unknown
CVE-2012-1039
Disclosure Date: March 19, 2012 (last updated October 04, 2023)
Multiple cross-site scripting (XSS) vulnerabilities in Dotclear before 2.4.2 allow remote attackers to inject arbitrary web script or HTML via the (1) login_data parameter to admin/auth.php; (2) nb parameter to admin/blogs.php; (3) type, (4) sortby, (5) order, or (6) status parameters to admin/comments.php; or (7) page parameter to admin/plugin.php.
0
Attacker Value
Unknown
CVE-2011-1584
Disclosure Date: June 08, 2011 (last updated October 04, 2023)
The updateFile function in inc/core/class.dc.media.php in the Media Manager in Dotclear before 2.2.3 does not properly restrict pathnames, which allows remote authenticated users to upload and execute arbitrary PHP code via the media_path or media_file parameter. NOTE: some of these details are obtained from third party information.
0
Attacker Value
Unknown
CVE-2009-0933
Disclosure Date: March 17, 2009 (last updated October 04, 2023)
Cross-site scripting (XSS) vulnerability in the administrative interface in Dotclear before 2.1.5 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
0
