Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in the media manager in Dotclear before 2.10 allow remote attackers to inject arbitrary web script or HTML via the 1 q or 2 linktype parameter to admin/media.php...

CVE-2016-6523

CVE-2016-6523 describes multiple cross-site scripting (XSS) vulnerabilities in the Dotclear media manager prior to version 2.10. The issue allows remote attackers to inject arbitrary web script or HTML by supplying crafted values to the parameters (1) q or (2) link_type in admin/media.php. The NV...

CVE-2016-6523

Multiple cross-site scripting XSS vulnerabilities in the media manager in Dotclear before 2.10 allow remote attackers to inject arbitrary web script or HTML via the 1 q or 2 linktype parameter to admin/media.php...

CVE-2016-6523: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in the media manager in Dotclear before 2.10 allow remote attackers to inject arbitrary web script or HTML via the 1 q or 2 linktype parameter to admin/media.php...

Arbitrary File Upload Vulnerability in Dotclear

Dotclear is an open source free web publishing software, created by Olivier Meunier in 2002. Dotclear suffers from an arbitrary file upload vulnerability. Due to the administrator theme management page blogtheme.php, inc/core/class.dc.modules.php there is a theme legitimacy checking problem,...

Dotclear Unrestricted File Upload Vulnerability

Dotclear is a software developer Olivier Meunier developed a free PHP and MySQL-based blog Blog publishing software. An unrestricted file upload vulnerability exists in the Blog appearance in the 'Install or upgrade manually' module of Dotclear 2.10.4 and earlier versions. A remote attacker can...

CVE-2016-9268

Unrestricted file upload vulnerability in the Blog appearance in the "Install or upgrade manually" module in Dotclear through 2.10.4 allows remote authenticated super-administrators to execute arbitrary code by uploading a theme file with an zip extension, and then accessing it via unspecified...

Unrestricted file upload

Unrestricted file upload vulnerability in the Blog appearance in the "Install or upgrade manually" module in Dotclear through 2.10.4 allows remote authenticated super-administrators to execute arbitrary code by uploading a theme file with an zip extension, and then accessing it via unspecified...

CVE-2016-9268

Unrestricted file upload vulnerability in the Blog appearance in the "Install or upgrade manually" module in Dotclear through 2.10.4 allows remote authenticated super-administrators to execute arbitrary code by uploading a theme file with an zip extension, and then accessing it via unspecified...

CVE-2016-9268

Dotclear vulnerability CVE-2016-9268: Unrestricted file upload in the Blog appearance (Install or upgrade manually) affects Dotclear up to version 2.10.4. A remote attacker with authenticated super-administrator rights can upload a theme file with a .zip extension and then access it via unspecifi...

CVE-2016-9268

Unrestricted file upload vulnerability in the Blog appearance in the "Install or upgrade manually" module in Dotclear through 2.10.4 allows remote authenticated super-administrators to execute arbitrary code by uploading a theme file with an zip extension, and then accessing it via unspecified...

CVE-2016-9268: Unrestricted Upload of File with Dangerous Type

Unrestricted file upload vulnerability in the Blog appearance in the "Install or upgrade manually" module in Dotclear through 2.10.4 allows remote authenticated super-administrators to execute arbitrary code by uploading a theme file with an zip extension, and then accessing it via unspecified...

Dotclear Password Reset Address Forgery Vulnerability

Dotclear is an open source free web publishing software. Dotclear suffers from a password reset address forgery vulnerability that can be exploited by an attacker to forge the hostname of a password reset address...

Dotclear Unlimited File Upload Vulnerability

Dotclear is an open source free web publishing software is an open source free web publishing software. An unrestricted file upload vulnerability exists in Dotclear, which can be exploited by an attacker to execute arbitrary PHP code by uploading a zip file...

Dotclear Directory Traversal Vulnerability

Dotclear is a software developer Olivier Meunier developed a free PHP and MySQL-based blog Blog publishing software. A directory traversal vulnerability exists in the media.php script in Dotclear version v2.9.1. An attacker can exploit this vulnerability by sending a request with the directory...

Dotclear Arbitrary File Upload Vulnerability

Dotclear is a free PHP and MySQL based blog publishing software. An arbitrary file upload vulnerability exists in Dotclear version 2.9.1, which could be exploited by an attacker to execute arbitrary code or elevate privileges within the context of an affected program...

Dotclear Security Bypass Vulnerability

Dotclear is a free PHP and MySQL based blog publishing software. A security bypass vulnerability exists in Dotclear version 2.9.1, which allows attackers to bypass certain security restrictions and perform unauthorized operations...

Dotclear 2.9.1 Shell Upload

Dotclear 2.9.1 Malicious File Upload Restriction Bypass + Software: https://dotclear.org/ + Author: Wiswat Aswamenakul + Affected version: only tested on 2.9.1 previous version might be affected + Platform: tested on Ubuntu 14.04, PHP 5.5.9 + Description Dotclear has a feature to upload files in...

Dotclear 2.9.1 Directory Download

Dotclear 2.9.1 Directory Download Vulnerability + Software: https://dotclear.org/ + Author: Wiswat Aswamenakul + Affected version: only tested on 2.9.1 previous version might be affected + Platform: tested on Ubuntu 14.04, PHP 5.5.9 + Description Authenticated users with media manager access...

Multiple Cross-Site Scripting Vulnerabilities in Dotclear

Dotclear is a PHP and MySQL based Blog system . Dotclear has multiple cross-site scripting vulnerabilities that can be exploited by attackers to execute arbitrary script code in a user's browser...