CVE-2023-53952 | High | 8.8 | 2025-12-19 | Dotclear 2.25.3 contains a remote code execution vulnerability that allows authenticated attackers to upload malicious PHP files with .phar extension through t… |
CVE-2024-58281 | High | 8.8 | 2025-12-10 | Dotclear 2.29 contains a remote code execution vulnerability that allows authenticated attackers to upload malicious PHP files through the media upload functio… |
CVE-2024-27626 | Medium | 6.1 | 2024-03-21 | A Reflected Cross-Site Scripting (XSS) vulnerability has been identified in Dotclear version 2.29. The flaw exists within the Search functionality of the Admin… |
CVE-2018-16358 | Medium | 5.4 | 2018-09-02 | A cross-site scripting (XSS) vulnerability in inc/core/class.dc.core.php in the media manager in Dotclear through 2.14.1 allows remote authenticated users to u… |
CVE-2018-5690 | Medium | 5.4 | 2018-01-14 | Cross-site scripting (XSS) vulnerability in admin/users.php in Dotclear 2.12.1 allows remote authenticated users to inject arbitrary web script or HTML via the… |
CVE-2018-5689 | Medium | 5.4 | 2018-01-14 | Cross-site scripting (XSS) vulnerability in admin/auth.php in Dotclear 2.12.1 allows remote authenticated users to inject arbitrary web script or HTML via the… |
CVE-2017-6446 | Medium | 6.1 | 2017-03-05 | XSS was discovered in Dotclear v2.11.2, affecting admin/blogs.php and admin/users.php with the sortby and order parameters. |
CVE-2015-8832 | High | 8.8 | 2017-02-09 | Multiple incomplete blacklist vulnerabilities in inc/core/class.dc.core.php in Dotclear before 2.8.2 allow remote authenticated users with "manage their own me… |
CVE-2015-8831 | Medium | 6.1 | 2017-02-09 | Cross-site scripting (XSS) vulnerability in admin/comments.php in Dotclear before 2.8.2 allows remote attackers to inject arbitrary web script or HTML via the… |
CVE-2016-7903 | Low | 3.7 | 2017-01-04 | Dotclear before 2.10.3, when the Host header is not part of the web server routing process, allows remote attackers to modify the password reset address link v… |
CVE-2016-7902 | High | 8.8 | 2017-01-04 | Unrestricted file upload vulnerability in the fileUnzip->unzip method in Dotclear before 2.10.3 allows remote authenticated users with permissions to manage me… |
CVE-2016-9891 | Medium | 5.4 | 2016-12-29 | Cross-site scripting (XSS) vulnerability in admin/media.php and admin/media_item.php in Dotclear before 2.11 allows remote authenticated users to inject arbitr… |
CVE-2016-6523 | Medium | 6.1 | 2016-12-09 | Multiple cross-site scripting (XSS) vulnerabilities in the media manager in Dotclear before 2.10 allow remote attackers to inject arbitrary web script or HTML… |
CVE-2016-9268 | High | 7.2 | 2016-11-10 | Unrestricted file upload vulnerability in the Blog appearance in the "Install or upgrade manually" module in Dotclear through 2.10.4 allows remote authenticate… |
CVE-2015-5651 | | | 2015-10-03 | Cross-site scripting (XSS) vulnerability in Dotclear before 2.8.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. |
CVE-2014-5316 | | | 2014-09-22 | Cross-site scripting (XSS) vulnerability in Dotclear before 2.6.4 allows remote attackers to inject arbitrary web script or HTML via a crafted page. |
CVE-2014-3782 | | | 2014-06-11 | Multiple incomplete blacklist vulnerabilities in the filemanager::isFileExclude method in the Media Manager in Dotclear before 2.6.3 allow remote authenticated… |
CVE-2014-3781 | | | 2014-06-11 | The dcXmlRpc::setUser method in nc/core/class.dc.xmlrpc.php in Dotclear before 2.6.3 allows remote attackers to bypass authentication via an empty password in… |
CVE-2014-3783 | | | 2014-05-22 | SQL injection vulnerability in admin/categories.php in Dotclear before 2.6.3 allows remote authenticated users with the manage categories permission to execute… |
CVE-2014-1613 | | | 2014-05-16 | Dotclear before 2.6.2 allows remote attackers to execute arbitrary PHP code via a serialized object in the dc_passwd cookie to a password-protected page, which… |
CVE-2012-1039 | | | 2012-03-19 | Multiple cross-site scripting (XSS) vulnerabilities in Dotclear before 2.4.2 allow remote attackers to inject arbitrary web script or HTML via the (1) login_da… |
CVE-2011-5083 | | | 2012-03-19 | Unrestricted file upload vulnerability in inc/swf/swfupload.swf in Dotclear 2.3.1 and 2.4.2 allows remote attackers to execute arbitrary code by uploading a fi… |
CVE-2011-1584 | | | 2011-06-08 | The updateFile function in inc/core/class.dc.media.php in the Media Manager in Dotclear before 2.2.3 does not properly restrict pathnames, which allows remote… |
CVE-2009-0933 | | | 2009-03-17 | Cross-site scripting (XSS) vulnerability in the administrative interface in Dotclear before 2.1.5 allows remote attackers to inject arbitrary web script or HTM… |
CVE-2008-3232 | | | 2008-07-18 | Unrestricted file upload vulnerability in ecrire/images.php in Dotclear 1.2.7.1 and earlier allows remote authenticated users to execute arbitrary code by uplo… |
CVE-2007-3688 | | | 2007-07-11 | Multiple cross-site request forgery (CSRF) vulnerabilities in DotClear 1.2.6 allow remote attackers to perform actions as arbitrary users via the (1) tool_url… |
CVE-2007-3672 | | | 2007-07-10 | Cross-site scripting (XSS) vulnerability in ecrire/tools.php in DotClear 1.2.6 allows remote attackers to inject arbitrary web script or HTML via unspecified f… |
CVE-2007-1989 | | | 2007-04-12 | Multiple cross-site scripting (XSS) vulnerabilities in DotClear before 1.2.6 allow remote attackers to inject arbitrary web script or HTML via the (1) post_id… |
CVE-2006-3938 | | | 2006-07-31 | DotClear allows remote attackers to obtain sensitive information via a direct request for (1) edit_cat.php, (2) index.php, (3) edit_link.php in ecrire/tools/bl… |
CVE-2006-2866 | | | 2006-06-06 | PHP remote file inclusion vulnerability in layout/prepend.php in DotClear 1.2.4 and earlier allows remote attackers to execute arbitrary PHP code via a FTP URL… |
CVE-2005-3963 | | | 2005-12-02 | SQL injection vulnerability in session.php in DotClear before 1.2.3 allows remote attackers to execute arbitrary SQL commands via the dc_xd parameter in a cook… |
CVE-2005-3957 | | | 2005-12-01 | Unspecified vulnerability in the Trackback functionality in DotClear 1.2.1 has unknown impact and attack vectors. |