PT-2017-9410

Name of the Vulnerable Software and Affected Versions Dotclear versions prior to 2.10.3 Description The issue allows remote authenticated users with permissions to manage media items to execute arbitrary code by uploading a ZIP file containing a file with a crafted extension. This can be achieved...

CVE-2016-7903: Undefined Security Weakness

Dotclear before 2.10.3, when the Host header is not part of the web server routing process, allows remote attackers to modify the password reset address link via the HTTP Host header...

PT-2017-9411

Name of the Vulnerable Software and Affected Versions Dotclear versions prior to 2.10.3 Description The issue allows remote attackers to modify the password reset address link by manipulating the HTTP Host header when it is not part of the web server routing process. Recommendations For versions...

CVE-2016-7902: Unrestricted Upload of File with Dangerous Type

Unrestricted file upload vulnerability in the fileUnzip-unzip method in Dotclear before 2.10.3 allows remote authenticated users with permissions to manage media items to execute arbitrary code by uploading a ZIP file containing a file with a crafted extension, as demonstrated by .php.txt or...

Dotclear cross-site scripting vulnerability (CNVD-2017-00084)

Dotclear is a software developer OlivierMeunier developed a free PHP and MySQL-based blog Blog publishing software. A cross-site scripting vulnerability exists in the admin/media.php and admin/mediaitem.ph files in versions of Dotclear prior to 2.11. A remote attacker can inject arbitrary web...

Cross site scripting

Cross-site scripting XSS vulnerability in admin/media.php and admin/mediaitem.php in Dotclear before 2.11 allows remote authenticated users to inject arbitrary web script or HTML via the upfiletitle or mediatitle parameter aka the media title...

CVE-2016-9891

Cross-site scripting XSS vulnerability in admin/media.php and admin/mediaitem.php in Dotclear before 2.11 allows remote authenticated users to inject arbitrary web script or HTML via the upfiletitle or mediatitle parameter aka the media title...

CVE-2016-9891

Cross-site scripting XSS vulnerability in admin/media.php and admin/mediaitem.php in Dotclear before 2.11 allows remote authenticated users to inject arbitrary web script or HTML via the upfiletitle or mediatitle parameter aka the media title...

UBUNTU-CVE-2016-9891

Cross-site scripting XSS vulnerability in admin/media.php and admin/mediaitem.php in Dotclear before 2.11 allows remote authenticated users to inject arbitrary web script or HTML via the upfiletitle or mediatitle parameter aka the media title...

CVE-2016-9891

Cross-site scripting XSS vulnerability in admin/media.php and admin/mediaitem.php in Dotclear before 2.11 allows remote authenticated users to inject arbitrary web script or HTML via the upfiletitle or mediatitle parameter aka the media title...

CVE-2016-9891

Cross-site scripting XSS vulnerability in admin/media.php and admin/mediaitem.php in Dotclear before 2.11 allows remote authenticated users to inject arbitrary web script or HTML via the upfiletitle or mediatitle parameter aka the media title...

CVE-2016-9891

Dotclear before version 2.11 contains a cross-site scripting (XSS) vulnerability in admin/media.php and admin/media_item.php that allows remote authenticated users to inject arbitrary web script or HTML via the upfiletitle or media_title parameters. Impact is described as XSS with typical user in...

CVE-2016-9891

Cross-site scripting XSS vulnerability in admin/media.php and admin/mediaitem.php in Dotclear before 2.11 allows remote authenticated users to inject arbitrary web script or HTML via the upfiletitle or mediatitle parameter aka the media title...

PT-2016-7864

Name of the Vulnerable Software and Affected Versions Dotclear versions prior to 2.11 Description A cross-site scripting XSS issue allows remote authenticated users to inject arbitrary web script or HTML via the upfiletitle or media title parameter in admin/media.php and admin/media item.php...

CVE-2016-9891: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in admin/media.php and admin/mediaitem.php in Dotclear before 2.11 allows remote authenticated users to inject arbitrary web script or HTML via the upfiletitle or mediatitle parameter aka the media title...

CVE-2016-6523

Multiple cross-site scripting XSS vulnerabilities in the media manager in Dotclear before 2.10 allow remote attackers to inject arbitrary web script or HTML via the 1 q or 2 linktype parameter to admin/media.php...

CVE-2016-6523

Multiple cross-site scripting XSS vulnerabilities in the media manager in Dotclear before 2.10 allow remote attackers to inject arbitrary web script or HTML via the 1 q or 2 linktype parameter to admin/media.php...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in the media manager in Dotclear before 2.10 allow remote attackers to inject arbitrary web script or HTML via the 1 q or 2 linktype parameter to admin/media.php...

CVE-2016-6523

Multiple cross-site scripting XSS vulnerabilities in the media manager in Dotclear before 2.10 allow remote attackers to inject arbitrary web script or HTML via the 1 q or 2 linktype parameter to admin/media.php...

CVE-2016-6523

Multiple cross-site scripting XSS vulnerabilities in the media manager in Dotclear before 2.10 allow remote attackers to inject arbitrary web script or HTML via the 1 q or 2 linktype parameter to admin/media.php...