Unscored severity · published Mar 17, 2009
CVE-2009-0933
Cross-site scripting (XSS) vulnerability in the administrative interface in Dotclear before 2.1.5 allows remote attackers to inject arbitrary web script or HTML via unspecified…
–
CVSS
1.1%
EPSS
No
On KEV
Description
Cross-site scripting (XSS) vulnerability in the administrative interface in Dotclear before 2.1.5 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Exploitation
Is it being used?
Exploit prediction (EPSS)1.1% · higher than 65% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
DO
Dotclear · Dotclear
through 2.1.4; 1.2.1; 1.2.2; 1.2.3; 1.2.4; 1.2.5; +18 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2009-0933
CVE.org
https://www.cve.org/CVERecord?id=CVE-2009-0933
Patch
http://dotclear.org/blog/post/2009/02/05/Dotclear-2.1.5
Vendor Advisory
http://secunia.com/advisories/34181
www.securityfocus.com
http://www.securityfocus.com/bid/34036
Patch
http://www.vupen.com/english/advisories/2009/0636
exchange.xforce.ibmcloud.com
https://exchange.xforce.ibmcloud.com/vulnerabilities/49138
More from Dotclear
8.8
CVE-2023-53952
Dotclear 2.25.3 Authenticated Remote Code Execution via File Upload
8.8
CVE-2024-58281
Dotclear 2.29 Remote Code Execution via Authenticated File Upload
8.8
CVE-2015-8832
Multiple incomplete blacklist vulnerabilities in inc/core/class.dc.core.php in Dotclear before 2.8.2 allow remote authenticated users with "manage their own media items" and…
8.8
CVE-2016-7902
Unrestricted file upload vulnerability in the fileUnzip->unzip method in Dotclear before 2.10.3 allows remote authenticated users with permissions to manage media items to execute…
7.2
CVE-2016-9268
Unrestricted file upload vulnerability in the Blog appearance in the "Install or upgrade manually" module in Dotclear through 2.10.4 allows remote authenticated…