Vulmon
Recent Vulnerabilities
Research Posts
Trends
Blog
About
Contact
Vulmon Alerts
By Relevance
By Risk Score
By Publish Date
dotclear dotclear vulnerabilities and exploits
(subscribe to this query)
NA
CVE-2014-3782
Multiple incomplete blacklist vulnerabilities in the filemanager::isFileExclude method in the Media Manager in Dotclear prior to 2.6.3 allow remote authenticated users to execute arbitrary PHP code by uploading a file with a (1) double extension or (2) .php5, (3) .phtml, or some ...
Dotclear Dotclear 2.6.1
Dotclear Dotclear 2.6
Dotclear Dotclear
NA
CVE-2005-3963
SQL injection vulnerability in session.php in DotClear prior to 1.2.3 allows remote malicious users to execute arbitrary SQL commands via the dc_xd parameter in a cookie.
Dotclear Dotclear 1.2.1
Dotclear Dotclear 1.2.2
1 EDB exploit
NA
CVE-2011-5083
Unrestricted file upload vulnerability in inc/swf/swfupload.swf in Dotclear 2.3.1 and 2.4.2 allows remote malicious users to execute arbitrary code by uploading a file with an executable PHP extension, then accessing it via a direct request to the file in an unspecified directory...
Dotclear Dotclear 2.4.2
Dotclear Dotclear 2.3.1
7.2
CVSSv3
CVE-2016-9268
Unrestricted file upload vulnerability in the Blog appearance in the "Install or upgrade manually" module in Dotclear up to and including 2.10.4 allows remote authenticated super-administrators to execute arbitrary code by uploading a theme file with an zip extension, a...
Dotclear Dotclear
6.1
CVSSv3
CVE-2016-6523
Multiple cross-site scripting (XSS) vulnerabilities in the media manager in Dotclear prior to 2.10 allow remote malicious users to inject arbitrary web script or HTML via the (1) q or (2) link_type parameter to admin/media.php.
Dotclear Dotclear
6.1
CVSSv3
CVE-2015-8831
Cross-site scripting (XSS) vulnerability in admin/comments.php in Dotclear prior to 2.8.2 allows remote malicious users to inject arbitrary web script or HTML via the author name in a comment.
Dotclear Dotclear
NA
CVE-2015-5651
Cross-site scripting (XSS) vulnerability in Dotclear prior to 2.8.1 allows remote malicious users to inject arbitrary web script or HTML via unspecified vectors.
Dotclear Dotclear
8.8
CVSSv3
CVE-2016-7902
Unrestricted file upload vulnerability in the fileUnzip->unzip method in Dotclear prior to 2.10.3 allows remote authenticated users with permissions to manage media items to execute arbitrary code by uploading a ZIP file containing a file with a crafted extension, as demonstra...
Dotclear Dotclear
3.7
CVSSv3
CVE-2016-7903
Dotclear prior to 2.10.3, when the Host header is not part of the web server routing process, allows remote malicious users to modify the password reset address link via the HTTP Host header.
Dotclear Dotclear
8.8
CVSSv3
CVE-2015-8832
Multiple incomplete blacklist vulnerabilities in inc/core/class.dc.core.php in Dotclear prior to 2.8.2 allow remote authenticated users with "manage their own media items" and "manage their own entries and comments" permissions to execute arbitrary PHP code by...
Dotclear Dotclear
CVSSv3
CVSSv2
CVSSv3
VMScore
Recommendations:
authentication bypass
CVE-2024-30051
remote
CVE-2024-27954
CVE-2023-51483
CVE-2023-47782
SSRF
CVE-2024-24715
CVE-2023-52424
Vulnerability Notification Service
You don’t have to wait for vulnerability scanning results
Get Started
« PREV
1
2
3
4
NEXT »