CVE-2018-16358

2018-09-0222:29:00

Google

osv.dev

4.8 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

29.2%

JSON

A cross-site scripting (XSS) vulnerability in inc/core/class.dc.core.php in the media manager in Dotclear through 2.14.1 allows remote authenticated users to upload HTML content containing an XSS payload with the file extension .ahtml.

CPENameOperatorVersion
dotcleareq2.6.4
dotcleareq2.7.2
dotcleareq2.13.1
dotcleareq2.11.0
dotcleareq2.4.3
dotcleareq2.7.1
dotcleareq2.13.0
dotcleareq2.8.1
dotcleareq2.10.2
dotcleareq2.9.0

Name	Operator	Version
dotclear	eq	2.6.4
dotclear	eq	2.7.2
dotclear	eq	2.13.1
dotclear	eq	2.11.0
dotclear	eq	2.4.3
dotclear	eq	2.7.1
dotclear	eq	2.13.0
dotclear	eq	2.8.1
dotclear	eq	2.10.2
dotclear	eq	2.9.0