DO
Vendor
dotclear
32
CVEs
0
On KEV
0
New 30D
Products
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2023-53952 | DO Dotclear Dotclear | 8.8 | Dec 19 | Dotclear 2.25.3 Authenticated Remote Code Execution via File Upload |
| CVE-2024-58281 | DO Dotclear dotclear | 8.8 | Dec 10 | Dotclear 2.29 Remote Code Execution via Authenticated File Upload |
| CVE-2024-27626 | DO Dotclear Dotclear | 6.1 | Mar 21 | A Reflected Cross-Site Scripting (XSS) vulnerability has been identified in Dotclear version 2.29 |
| CVE-2018-16358 | DO Dotclear Dotclear | 5.4 | Sep 2 | A cross-site scripting (XSS) vulnerability in inc/core/class.dc.core.php in the media manager in Dotclear through 2.14.1 allows remote authenticated users to upload HTML content… |
| CVE-2018-5690 | DO Dotclear Dotclear | 5.4 | Jan 14 | Cross-site scripting (XSS) vulnerability in admin/users.php in Dotclear 2.12.1 allows remote authenticated users to inject arbitrary web script or HTML via the nb parameter (aka… |
| CVE-2018-5689 | DO Dotclear Dotclear | 5.4 | Jan 14 | Cross-site scripting (XSS) vulnerability in admin/auth.php in Dotclear 2.12.1 allows remote authenticated users to inject arbitrary web script or HTML via the malicious user's… |
| CVE-2017-6446 | DO Dotclear Dotclear | 6.1 | Mar 5 | XSS was discovered in Dotclear v2.11.2, affecting admin/blogs.php and admin/users.php with the sortby and order parameters |
| CVE-2015-8832 | DO Dotclear Dotclear | 8.8 | Feb 9 | Multiple incomplete blacklist vulnerabilities in inc/core/class.dc.core.php in Dotclear before 2.8.2 allow remote authenticated users with "manage their own media items" and… |
| CVE-2015-8831 | DO Dotclear Dotclear | 6.1 | Feb 9 | Cross-site scripting (XSS) vulnerability in admin/comments.php in Dotclear before 2.8.2 allows remote attackers to inject arbitrary web script or HTML via the author name in a… |
| CVE-2016-7903 | DO Dotclear Dotclear | 3.7 | Jan 4 | Dotclear before 2.10.3, when the Host header is not part of the web server routing process, allows remote attackers to modify the password reset address link via the HTTP Host… |
| CVE-2016-7902 | DO Dotclear Dotclear | 8.8 | Jan 4 | Unrestricted file upload vulnerability in the fileUnzip->unzip method in Dotclear before 2.10.3 allows remote authenticated users with permissions to manage media items to execute… |
| CVE-2016-9891 | DO Dotclear Dotclear | 5.4 | Dec 29 | Cross-site scripting (XSS) vulnerability in admin/media.php and admin/media_item.php in Dotclear before 2.11 allows remote authenticated users to inject arbitrary web script or… |
| CVE-2016-6523 | DO Dotclear Dotclear | 6.1 | Dec 9 | Multiple cross-site scripting (XSS) vulnerabilities in the media manager in Dotclear before 2.10 allow remote attackers to inject arbitrary web script or HTML via the (1) q or (2)… |
| CVE-2016-9268 | DO Dotclear Dotclear | 7.2 | Nov 10 | Unrestricted file upload vulnerability in the Blog appearance in the "Install or upgrade manually" module in Dotclear through 2.10.4 allows remote authenticated… |
| CVE-2015-5651 | DO Dotclear Dotclear | – | Oct 3 | Cross-site scripting (XSS) vulnerability in Dotclear before 2.8.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors |
| CVE-2014-5316 | DO Dotclear Dotclear | – | Sep 22 | Cross-site scripting (XSS) vulnerability in Dotclear before 2.6.4 allows remote attackers to inject arbitrary web script or HTML via a crafted page |
| CVE-2014-3782 | DO Dotclear Dotclear | – | Jun 11 | Multiple incomplete blacklist vulnerabilities in the filemanager::isFileExclude method in the Media Manager in Dotclear before 2.6.3 allow remote authenticated users to execute… |
| CVE-2014-3781 | DO Dotclear Dotclear | – | Jun 11 | The dcXmlRpc::setUser method in nc/core/class.dc.xmlrpc.php in Dotclear before 2.6.3 allows remote attackers to bypass authentication via an empty password in an XML-RPC request |
| CVE-2014-3783 | DO Dotclear Dotclear | – | May 22 | SQL injection vulnerability in admin/categories.php in Dotclear before 2.6.3 allows remote authenticated users with the manage categories permission to execute arbitrary SQL… |
| CVE-2014-1613 | DO Dotclear Dotclear | – | May 16 | Dotclear before 2.6.2 allows remote attackers to execute arbitrary PHP code via a serialized object in the dc_passwd cookie to a password-protected page, which is not properly… |
| CVE-2012-1039 | DO Dotclear Dotclear | – | Mar 19 | Multiple cross-site scripting (XSS) vulnerabilities in Dotclear before 2.4.2 allow remote attackers to inject arbitrary web script or HTML via the (1) login_data parameter to… |
| CVE-2011-5083 | DO Dotclear Dotclear | – | Mar 19 | Unrestricted file upload vulnerability in inc/swf/swfupload.swf in Dotclear 2.3.1 and 2.4.2 allows remote attackers to execute arbitrary code by uploading a file with an… |
| CVE-2011-1584 | DO Dotclear Dotclear | – | Jun 8 | The updateFile function in inc/core/class.dc.media.php in the Media Manager in Dotclear before 2.2.3 does not properly restrict pathnames, which allows remote authenticated users… |
| CVE-2009-0933 | DO Dotclear Dotclear | – | Mar 17 | Cross-site scripting (XSS) vulnerability in the administrative interface in Dotclear before 2.1.5 allows remote attackers to inject arbitrary web script or HTML via unspecified… |
| CVE-2008-3232 | DO Dotclear Dotclear | – | Jul 18 | Unrestricted file upload vulnerability in ecrire/images.php in Dotclear 1.2.7.1 and earlier allows remote authenticated users to execute arbitrary code by uploading a file with an… |
| CVE-2007-3688 | DO Dotclear Dotclear | – | Jul 11 | Multiple cross-site request forgery (CSRF) vulnerabilities in DotClear 1.2.6 allow remote attackers to perform actions as arbitrary users via the (1) tool_url parameter to… |
| CVE-2007-3672 | DO Dotclear Dotclear | – | Jul 10 | Cross-site scripting (XSS) vulnerability in ecrire/tools.php in DotClear 1.2.6 allows remote attackers to inject arbitrary web script or HTML via unspecified form fields on the… |
| CVE-2007-1989 | DO Dotclear Dotclear | – | Apr 12 | Multiple cross-site scripting (XSS) vulnerabilities in DotClear before 1.2.6 allow remote attackers to inject arbitrary web script or HTML via the (1) post_id parameter to… |
| CVE-2006-3938 | DO Dotclear Dotclear | – | Jul 31 | DotClear allows remote attackers to obtain sensitive information via a direct request for (1) edit_cat.php, (2) index.php, (3) edit_link.php in ecrire/tools/blogroll/; (4)… |
| CVE-2006-2866 | DO Dotclear Dotclear | – | Jun 6 | PHP remote file inclusion vulnerability in layout/prepend.php in DotClear 1.2.4 and earlier allows remote attackers to execute arbitrary PHP code via a FTP URL in the blog_dc_path… |
| CVE-2005-3963 | DO Dotclear Dotclear | – | Dec 2 | SQL injection vulnerability in session.php in DotClear before 1.2.3 allows remote attackers to execute arbitrary SQL commands via the dc_xd parameter in a cookie |
| CVE-2005-3957 | DO Dotclear Dotclear | – | Dec 1 | Unspecified vulnerability in the Trackback functionality in DotClear 1.2.1 has unknown impact and attack vectors |