CVE-2017-6446

XSS was discovered in Dotclear v2.11.2, affecting admin/blogs.php and admin/users.php with the sortby and order parameters...

CVE-2017-6446

Dotclear v2.11.2 contains a reflected cross-site scripting (XSS) vulnerability in admin/pages that handle sorting (admin/blogs.php and admin/users.php with sortby and order parameters). The issue is identified as CVE-2017-6446. The available documents describe the vulnerable vectors and affected ...

CVE-2017-6446

XSS was discovered in Dotclear v2.11.2, affecting admin/blogs.php and admin/users.php with the sortby and order parameters...

CVE-2017-6446

XSS was discovered in Dotclear v2.11.2, affecting admin/blogs.php and admin/users.php with the sortby and order parameters...

PT-2017-17072

Name of the Vulnerable Software and Affected Versions Dotclear version 2.11.2 Description A cross-site scripting issue was found, affecting the "admin/blogs.php" and "admin/users.php" API endpoints, specifically the sortby and order parameters. Recommendations For Dotclear version 2.11.2, conside...

CVE-2017-6446: Improper Neutralization of Input During Web Page Generation

XSS was discovered in Dotclear v2.11.2, affecting admin/blogs.php and admin/users.php with the sortby and order parameters...

Dotclear Arbitrary PHP Code Execution Vulnerability

Dotclear is a software developer Olivier Meunier developed a free PHP and MySQL-based blog Blog publishing software. A security vulnerability exists in the inc/core/class.dc.core.php file in versions of Dotclear prior to 2.8.2. A remote attacker can exploit this vulnerability by uploading a file...

Dotclear cross-site scripting vulnerability (CNVD-2017-01936)

Dotclear is a software developer Olivier Meunier developed a free PHP and MySQL-based blog Blog publishing software. A cross-site scripting vulnerability exists in the admin/comments.php file in versions of Dotclear prior to 2.8.2. This vulnerability can be exploited by a remote attacker to injec...

CVE-2015-8831

Cross-site scripting XSS vulnerability in admin/comments.php in Dotclear before 2.8.2 allows remote attackers to inject arbitrary web script or HTML via the author name in a comment...

CVE-2015-8832

Multiple incomplete blacklist vulnerabilities in inc/core/class.dc.core.php in Dotclear before 2.8.2 allow remote authenticated users with "manage their own media items" and "manage their own entries and comments" permissions to execute arbitrary PHP code by uploading a file with a 1 .pht, 2 .php...

Cross site scripting

Cross-site scripting XSS vulnerability in admin/comments.php in Dotclear before 2.8.2 allows remote attackers to inject arbitrary web script or HTML via the author name in a comment...

UBUNTU-CVE-2015-8831

Cross-site scripting XSS vulnerability in admin/comments.php in Dotclear before 2.8.2 allows remote attackers to inject arbitrary web script or HTML via the author name in a comment...

CVE-2015-8831

Cross-site scripting XSS vulnerability in admin/comments.php in Dotclear before 2.8.2 allows remote attackers to inject arbitrary web script or HTML via the author name in a comment...

CVE-2015-8832

Multiple incomplete blacklist vulnerabilities in inc/core/class.dc.core.php in Dotclear before 2.8.2 allow remote authenticated users with "manage their own media items" and "manage their own entries and comments" permissions to execute arbitrary PHP code by uploading a file with a 1 .pht, 2 .php...

UBUNTU-CVE-2015-8832

Multiple incomplete blacklist vulnerabilities in inc/core/class.dc.core.php in Dotclear before 2.8.2 allow remote authenticated users with "manage their own media items" and "manage their own entries and comments" permissions to execute arbitrary PHP code by uploading a file with a 1 .pht, 2 .php...

CVE-2015-8831

Cross-site scripting XSS vulnerability in admin/comments.php in Dotclear before 2.8.2 allows remote attackers to inject arbitrary web script or HTML via the author name in a comment...

CVE-2015-8832

Multiple incomplete blacklist vulnerabilities in inc/core/class.dc.core.php in Dotclear before 2.8.2 allow remote authenticated users with "manage their own media items" and "manage their own entries and comments" permissions to execute arbitrary PHP code by uploading a file with a 1 .pht, 2 .php...

CVE-2015-8832

Multiple incomplete blacklist vulnerabilities in inc/core/class.dc.core.php in Dotclear before 2.8.2 allow remote authenticated users with "manage their own media items" and "manage their own entries and comments" permissions to execute arbitrary PHP code by uploading a file with a 1 .pht, 2 .php...

CVE-2015-8831

Cross-site scripting XSS vulnerability in admin/comments.php in Dotclear before 2.8.2 allows remote attackers to inject arbitrary web script or HTML via the author name in a comment...

CVE-2015-8831

Dotclear before 2.8.2 contains an XSS vulnerability in admin/comments.php that lets remote attackers inject arbitrary script or HTML through the author name in a comment. Root cause: insufficient input sanitization of the author field in comments; impact is user-facing script execution (per the C...