Filtered by vendor Dotclear
Subscriptions
Total
29 CVE
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2016-6523 | 1 Dotclear | 1 Dotclear | 2016-12-13 | N/A |
| Multiple cross-site scripting (XSS) vulnerabilities in the media manager in Dotclear before 2.10 allow remote attackers to inject arbitrary web script or HTML via the (1) q or (2) link_type parameter to admin/media.php. | ||||
| CVE-2016-9268 | 1 Dotclear | 1 Dotclear | 2016-11-29 | N/A |
| Unrestricted file upload vulnerability in the Blog appearance in the "Install or upgrade manually" module in Dotclear through 2.10.4 allows remote authenticated super-administrators to execute arbitrary code by uploading a theme file with an zip extension, and then accessing it via unspecified vectors. | ||||
| CVE-2015-5651 | 1 Dotclear | 1 Dotclear | 2015-10-05 | N/A |
| Cross-site scripting (XSS) vulnerability in Dotclear before 2.8.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. | ||||
| CVE-2014-5316 | 1 Dotclear | 1 Dotclear | 2015-09-08 | N/A |
| Cross-site scripting (XSS) vulnerability in Dotclear before 2.6.4 allows remote attackers to inject arbitrary web script or HTML via a crafted page. | ||||
| CVE-2014-3782 | 1 Dotclear | 1 Dotclear | 2014-06-12 | N/A |
| Multiple incomplete blacklist vulnerabilities in the filemanager::isFileExclude method in the Media Manager in Dotclear before 2.6.3 allow remote authenticated users to execute arbitrary PHP code by uploading a file with a (1) double extension or (2) .php5, (3) .phtml, or some other PHP file extension. | ||||
| CVE-2014-3781 | 1 Dotclear | 1 Dotclear | 2014-06-12 | N/A |
| The dcXmlRpc::setUser method in nc/core/class.dc.xmlrpc.php in Dotclear before 2.6.3 allows remote attackers to bypass authentication via an empty password in an XML-RPC request. | ||||
| CVE-2014-1613 | 1 Dotclear | 1 Dotclear | 2014-05-16 | N/A |
| Dotclear before 2.6.2 allows remote attackers to execute arbitrary PHP code via a serialized object in the dc_passwd cookie to a password-protected page, which is not properly handled by (1) inc/public/lib.urlhandlers.php or (2) plugins/pages/_public.php. | ||||
| CVE-2007-3672 | 1 Dotclear | 1 Dotclear | 2008-11-15 | N/A |
| Cross-site scripting (XSS) vulnerability in ecrire/tools.php in DotClear 1.2.6 allows remote attackers to inject arbitrary web script or HTML via unspecified form fields on the blogroll page. | ||||
| CVE-2005-3957 | 1 Dotclear | 1 Dotclear | 2008-09-05 | N/A |
| Unspecified vulnerability in the Trackback functionality in DotClear 1.2.1 has unknown impact and attack vectors. | ||||