Dotclear

Dotclear

32 Schwachstellen gefunden.

Hinweis: Diese Liste kann unvollständig sein. Daten werden ohne Gewähr im Ursprungsformat bereitgestellt.
8.8

CVE-2023-53952

Exploit
  • EPSS 0.69%
  • Veröffentlicht 19.12.2025 21:15:51
  • Zuletzt bearbeitet 24.12.2025 16:57:35

Dotclear 2.25.3 contains a remote code execution vulnerability that allows authenticated attackers to upload malicious PHP files with .phar extension through the blog post creation interface. Attackers can upload files containing PHP system commands ...

8.8

CVE-2024-58281

Exploit
  • EPSS 0.27%
  • Veröffentlicht 10.12.2025 21:13:56
  • Zuletzt bearbeitet 19.12.2025 17:50:14

Dotclear 2.29 contains a remote code execution vulnerability that allows authenticated attackers to upload malicious PHP files through the media upload functionality. Attackers can exploit the file upload process by crafting a PHP shell with a comman...

6.1

CVE-2024-27626

  • EPSS 0.11%
  • Veröffentlicht 21.03.2024 02:52:20
  • Zuletzt bearbeitet 17.06.2025 13:57:09

A Reflected Cross-Site Scripting (XSS) vulnerability has been identified in Dotclear version 2.29. The flaw exists within the Search functionality of the Admin Panel.

5.4

CVE-2018-16358

  • EPSS 0.2%
  • Veröffentlicht 02.09.2018 22:29:00
  • Zuletzt bearbeitet 21.11.2024 03:52:35

A cross-site scripting (XSS) vulnerability in inc/core/class.dc.core.php in the media manager in Dotclear through 2.14.1 allows remote authenticated users to upload HTML content containing an XSS payload with the file extension .ahtml.

5.4

CVE-2018-5690

  • EPSS 0.2%
  • Veröffentlicht 14.01.2018 04:29:00
  • Zuletzt bearbeitet 21.11.2024 04:09:10

Cross-site scripting (XSS) vulnerability in admin/users.php in Dotclear 2.12.1 allows remote authenticated users to inject arbitrary web script or HTML via the nb parameter (aka the page limit number).

5.4

CVE-2018-5689

  • EPSS 0.2%
  • Veröffentlicht 14.01.2018 04:29:00
  • Zuletzt bearbeitet 21.11.2024 04:09:10

Cross-site scripting (XSS) vulnerability in admin/auth.php in Dotclear 2.12.1 allows remote authenticated users to inject arbitrary web script or HTML via the malicious user's email.

6.1

CVE-2017-6446

  • EPSS 0.24%
  • Veröffentlicht 05.03.2017 21:59:00
  • Zuletzt bearbeitet 20.04.2025 01:37:25

XSS was discovered in Dotclear v2.11.2, affecting admin/blogs.php and admin/users.php with the sortby and order parameters.

8.8

CVE-2015-8832

Exploit
  • EPSS 0.92%
  • Veröffentlicht 09.02.2017 15:59:00
  • Zuletzt bearbeitet 20.04.2025 01:37:25

Multiple incomplete blacklist vulnerabilities in inc/core/class.dc.core.php in Dotclear before 2.8.2 allow remote authenticated users with "manage their own media items" and "manage their own entries and comments" permissions to execute arbitrary PHP...

6.1

CVE-2015-8831

Exploit
  • EPSS 0.93%
  • Veröffentlicht 09.02.2017 15:59:00
  • Zuletzt bearbeitet 20.04.2025 01:37:25

Cross-site scripting (XSS) vulnerability in admin/comments.php in Dotclear before 2.8.2 allows remote attackers to inject arbitrary web script or HTML via the author name in a comment.

4.3

CVE-2016-7903

  • EPSS 0.28%
  • Veröffentlicht 04.01.2017 21:59:00
  • Zuletzt bearbeitet 12.04.2025 10:46:40

Dotclear before 2.10.3, when the Host header is not part of the web server routing process, allows remote attackers to modify the password reset address link via the HTTP Host header.