Dotclear - vulnerabilities (CVEs)

32 CVEs in 1 products, 0 in the last 30 days, newest from 2025-12-19.

Products

• Dotclear - 32 CVEs

Newest CVEs of Dotclear

• CVE-2023-53952 - CVSS 8.8 (high), 2025-12-19: Dotclear 2.25.3 contains a remote code execution vulnerability that allows authenticated attackers to upload malicious PHP files with .phar extension through…
• CVE-2024-58281 - CVSS 8.8 (high), 2025-12-10: Dotclear 2.29 contains a remote code execution vulnerability that allows authenticated attackers to upload malicious PHP files through the media upload…
• CVE-2024-27626 - CVSS 6.1 (medium), 2024-03-21: A Reflected Cross-Site Scripting (XSS) vulnerability has been identified in Dotclear version 2.29. The flaw exists within the Search functionality of the…
• CVE-2018-16358 - CVSS 5.4 (medium), 2018-09-02: A cross-site scripting (XSS) vulnerability in inc/core/class.dc.core.php in the media manager in Dotclear through 2.14.1 allows remote authenticated users to…
• CVE-2018-5689 - CVSS 5.4 (medium), 2018-01-14: Cross-site scripting (XSS) vulnerability in admin/auth.php in Dotclear 2.12.1 allows remote authenticated users to inject arbitrary web script or HTML via the…
• CVE-2018-5690 - CVSS 5.4 (medium), 2018-01-14: Cross-site scripting (XSS) vulnerability in admin/users.php in Dotclear 2.12.1 allows remote authenticated users to inject arbitrary web script or HTML via…
• CVE-2017-6446 - CVSS 6.1 (medium), 2017-03-05: XSS was discovered in Dotclear v2.11.2, affecting admin/blogs.php and admin/users.php with the sortby and order parameters.
• CVE-2015-8832 - CVSS 8.8 (high), 2017-02-09: Multiple incomplete blacklist vulnerabilities in inc/core/class.dc.core.php in Dotclear before 2.8.2 allow remote authenticated users with "manage their own…
• CVE-2015-8831 - CVSS 6.1 (medium), 2017-02-09: Cross-site scripting (XSS) vulnerability in admin/comments.php in Dotclear before 2.8.2 allows remote attackers to inject arbitrary web script or HTML via the…
• CVE-2016-7903 - CVSS 3.7 (low), 2017-01-04: Dotclear before 2.10.3, when the Host header is not part of the web server routing process, allows remote attackers to modify the password reset address link…
• CVE-2016-7902 - CVSS 8.8 (high), 2017-01-04: Unrestricted file upload vulnerability in the fileUnzip->unzip method in Dotclear before 2.10.3 allows remote authenticated users with permissions to manage…
• CVE-2016-9891 - CVSS 5.4 (medium), 2016-12-29: Cross-site scripting (XSS) vulnerability in admin/media.php and admin/media_item.php in Dotclear before 2.11 allows remote authenticated users to inject…
• CVE-2016-6523 - CVSS 6.1 (medium), 2016-12-09: Multiple cross-site scripting (XSS) vulnerabilities in the media manager in Dotclear before 2.10 allow remote attackers to inject arbitrary web script or HTML…
• CVE-2016-9268 - CVSS 7.2 (high), 2016-11-10: Unrestricted file upload vulnerability in the Blog appearance in the "Install or upgrade manually" module in Dotclear through 2.10.4 allows remote…
• CVE-2015-5651 - CVSS 4.3 (medium), 2015-10-03: Cross-site scripting (XSS) vulnerability in Dotclear before 2.8.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
• CVE-2014-5316 - CVSS 4.3 (medium), 2014-09-22: Cross-site scripting (XSS) vulnerability in Dotclear before 2.6.4 allows remote attackers to inject arbitrary web script or HTML via a crafted page.
• CVE-2014-3782 - CVSS 6 (medium), 2014-06-11: Multiple incomplete blacklist vulnerabilities in the filemanager::isFileExclude method in the Media Manager in Dotclear before 2.6.3 allow remote…
• CVE-2014-3781 - CVSS 5.8 (medium), 2014-06-11: The dcXmlRpc::setUser method in nc/core/class.dc.xmlrpc.php in Dotclear before 2.6.3 allows remote attackers to bypass authentication via an empty password in…
• CVE-2014-3783 - CVSS 6 (medium), 2014-05-22: SQL injection vulnerability in admin/categories.php in Dotclear before 2.6.3 allows remote authenticated users with the manage categories permission to…
• CVE-2014-1613 - CVSS 7.5 (high), 2014-05-16: Dotclear before 2.6.2 allows remote attackers to execute arbitrary PHP code via a serialized object in the dc_passwd cookie to a password-protected page,…
• CVE-2012-1039 - CVSS 4.3 (medium), 2012-03-19: Multiple cross-site scripting (XSS) vulnerabilities in Dotclear before 2.4.2 allow remote attackers to inject arbitrary web script or HTML via the (1)…
• CVE-2011-5083 - CVSS 7.5 (high), 2012-03-19: Unrestricted file upload vulnerability in inc/swf/swfupload.swf in Dotclear 2.3.1 and 2.4.2 allows remote attackers to execute arbitrary code by uploading a…
• CVE-2011-1584 - CVSS 6.5 (medium), 2011-06-08: The updateFile function in inc/core/class.dc.media.php in the Media Manager in Dotclear before 2.2.3 does not properly restrict pathnames, which allows remote…
• CVE-2009-0933 - CVSS 4.3 (medium), 2009-03-17: Cross-site scripting (XSS) vulnerability in the administrative interface in Dotclear before 2.1.5 allows remote attackers to inject arbitrary web script or…
• CVE-2008-3232 - CVSS 9.3 (critical), 2008-07-18: Unrestricted file upload vulnerability in ecrire/images.php in Dotclear 1.2.7.1 and earlier allows remote authenticated users to execute arbitrary code by…
• CVE-2007-3688 - CVSS 2.6 (low), 2007-07-11: Multiple cross-site request forgery (CSRF) vulnerabilities in DotClear 1.2.6 allow remote attackers to perform actions as arbitrary users via the (1) tool_url…
• CVE-2007-3672 - CVSS 4.3 (medium), 2007-07-10: Cross-site scripting (XSS) vulnerability in ecrire/tools.php in DotClear 1.2.6 allows remote attackers to inject arbitrary web script or HTML via unspecified…
• CVE-2007-1989 - CVSS 4.3 (medium), 2007-04-12: Multiple cross-site scripting (XSS) vulnerabilities in DotClear before 1.2.6 allow remote attackers to inject arbitrary web script or HTML via the (1) post_id…
• CVE-2006-3938 - CVSS 5 (medium), 2006-07-31: DotClear allows remote attackers to obtain sensitive information via a direct request for (1) edit_cat.php, (2) index.php, (3) edit_link.php in…
• CVE-2006-2866 - CVSS 5.1 (medium), 2006-06-06: PHP remote file inclusion vulnerability in layout/prepend.php in DotClear 1.2.4 and earlier allows remote attackers to execute arbitrary PHP code via a FTP…