Default credentials

2014-05-1615:55:00

PRIOn knowledge base

www.prio-n.com

8.1 High

AI Score

Confidence

Low

0.005 Low

EPSS

Percentile

76.3%

JSON

Dotclear before 2.6.2 allows remote attackers to execute arbitrary PHP code via a serialized object in the dc_passwd cookie to a password-protected page, which is not properly handled by (1) inc/public/lib.urlhandlers.php or (2) plugins/pages/_public.php.

CPENameOperatorVersion
dotcleareq2.0 beta-7
dotcleareq2.0 beta-5.4
dotcleareq2.2.1
dotcleareq2.0 beta-5.2
dotcleareq2.1
dotcleareq2.0.1
dotcleareq2.4.4
dotclearle2.6.1
dotcleareq2.0.2
dotcleareq2.1.4

Name	Operator	Version
dotclear	eq	2.0 beta-7
dotclear	eq	2.0 beta-5.4
dotclear	eq	2.2.1
dotclear	eq	2.0 beta-5.2
dotclear	eq	2.1
dotclear	eq	2.0.1
dotclear	eq	2.4.4
dotclear	le	2.6.1
dotclear	eq	2.0.2
dotclear	eq	2.1.4