CVE-2018-16358

A cross-site scripting (XSS) vulnerability in inc/core/class.dc.core.php in the media manager in Dotclear through 2.14.1 allows remote authenticated users to upload HTML content containing an XSS payload with the file extension .ahtml.

Score

CVSS 3.0 5.4 Medium

Status

Modified - cve@mitre.org

Published

2018-09-02

Last modified

2024-08-05

Weaknesses

CWE-79

Affected products

• Dotclear (Dotclear)

References

• https://hg.dotclear.org/dotclear/rev/d4841d6d65d6