314 matches found
Cross site scripting
Multiple cross-site scripting XSS vulnerabilities in DotClear before 1.2.6 allow remote attackers to inject arbitrary web script or HTML via the 1 postid parameter to ecrire/trackback.php or the 2 toolurl parameter to tools/thememng/index.php. NOTE: some of these details are obtained from third...
CVE-2007-1989
Multiple cross-site scripting XSS vulnerabilities in DotClear before 1.2.6 allow remote attackers to inject arbitrary web script or HTML via the 1 postid parameter to ecrire/trackback.php or the 2 toolurl parameter to tools/thememng/index.php. NOTE: some of these details are obtained from third...
CVE-2007-1989
Multiple cross-site scripting XSS vulnerabilities in DotClear before 1.2.6 allow remote attackers to inject arbitrary web script or HTML via the 1 postid parameter to ecrire/trackback.php or the 2 toolurl parameter to tools/thememng/index.php. NOTE: some of these details are obtained from third...
CVE-2007-1989
DotClear prior to 1.2.6 contains multiple XSS flaws that allow remote attackers to inject arbitrary script or HTML via (1) post_id in ecrire/trackback.php or (2) tool_url in tools/thememng/index.php. The NVD entry confirms these XSS vectors and notes details are sourced from third-party informati...
CVE-2007-1989
Multiple cross-site scripting XSS vulnerabilities in DotClear before 1.2.6 allow remote attackers to inject arbitrary web script or HTML via the 1 postid parameter to ecrire/trackback.php or the 2 toolurl parameter to tools/thememng/index.php. NOTE: some of these details are obtained from third...
dotclear-xss.txt
------=Part236063482423.1176380209314 Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit Content-Disposition: inline Dotclear 1. Cross Site Scripting Vulnerability 1--two cross site scripting vulnerabilities have been discovered in the dotclear1. allowing ...
DotClear 1.2.x - toolsthememngindex.php?tool_url Cross-Site Scripting
DotClear 1.2.x - toolsthememngindex.php?toolurl Cross-Site Scripting source: https://www.securityfocus.com/bid/23411/info DotClear is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input. An attacker may leverage these issues to execute...
DotClear 1.2.x - ecriretrackback.php?post_id Cross-Site Scripting
DotClear 1.2.x - ecriretrackback.php?postid Cross-Site Scripting source: https://www.securityfocus.com/bid/23411/info DotClear is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input. An attacker may leverage these issues to execute...
DotClear 1.2.x - '/tools/thememng/index.php?tool_url' Cross-Site Scripting
source: https://www.securityfocus.com/bid/23411/info DotClear is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input. An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the...
DotClear 1.2.x - '/ecrire/trackback.php?post_id' Cross-Site Scripting
source: https://www.securityfocus.com/bid/23411/info DotClear is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input. An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the...
DotClear v1.2.5
DotClear v1.2.5 = RFi Vulnerabilities KaRTaL Download : http://www.spacemarc.it/scriptphp/index.php?script=meganoidesnews111 Script Name : DotClear v1.2.5 Coded By : KaRTaL Contact : k4rtalatgmaildotcom V.Code in : path/index.php require $blogdcpath.'/layout/append.php'; Exploit :...
DotClear Full Path Disclosure Vulnerability
I have contacted the developers 2 weeks ago, still no answer... Vendor: DotClear Vulnerable: DotClear 1.2.5 and below Release Date: 2007-01-28 Full Path Disclosure This vulnerability affects: http://www.example.com/dotclear/themes/default/form.php...
CVE-2006-3938
DotClear allows remote attackers to obtain sensitive information via a direct request for 1 editcat.php, 2 index.php, 3 editlink.php in ecrire/tools/blogroll/; 4 syslog/index.php, 5 thememng/index.php, 6 toolsmng/index.php, 7 utf8convert/index.php in /ecrire/tools/; 8 /ecrire/inc/connexion.php an...
CVE-2006-3938
CVE-2006-3938 affects DotClear. The vulnerability allows remote attackers to obtain sensitive information by directly requesting multiple files (e.g., edit_cat.php, syslog/index.php, class.blog.php, template.php) under /ecrire/tools/, /inc/, /layout/, and /themes/default/. The root cause is that ...
CVE-2006-3938
DotClear allows remote attackers to obtain sensitive information via a direct request for 1 editcat.php, 2 index.php, 3 editlink.php in ecrire/tools/blogroll/; 4 syslog/index.php, 5 thememng/index.php, 6 toolsmng/index.php, 7 utf8convert/index.php in /ecrire/tools/; 8 /ecrire/inc/connexion.php an...
DotClear : Multiples Full Path Disclosure
DotClear : Multiples Full Path Disclosure Discovred By Silitix - Silitixgmailcom www.Silitix.com A remote user can access the files directly to cause the system to display an error message that indicates the full path of the server. /ecrire/tools/blogroll/editcat.php...
CVE-2006-2866
PHP remote file inclusion vulnerability in layout/prepend.php in DotClear 1.2.4 and earlier allows remote attackers to execute arbitrary PHP code via a FTP URL in the blogdcpath parameter, which passes fileexists and isdir tests on PHP 5...
Remote file inclusion
PHP remote file inclusion vulnerability in layout/prepend.php in DotClear 1.2.4 and earlier allows remote attackers to execute arbitrary PHP code via a FTP URL in the blogdcpath parameter, which passes fileexists and isdir tests on PHP 5...
CVE-2006-2866
PHP remote file inclusion vulnerability in layout/prepend.php in DotClear 1.2.4 and earlier allows remote attackers to execute arbitrary PHP code via a FTP URL in the blogdcpath parameter, which passes fileexists and isdir tests on PHP 5...