dotclear

13 results · Feed

• High 8.8
  CVE-2023-53952

  Dotclear 2.25.3 Authenticated Remote Code Execution via File Upload

  Dotclear 2.25.3 contains a remote code execution vulnerability that allows authenticated attackers to upload malicious PHP files with .phar extension through the blog post creation interface. Attackers can upload files containing PHP system commands that exec…

  dotclear Dotclear dotclear Ubuntu
  Dec 19, 2025
• High 8.7
  CVE-2024-58281

  Dotclear 2.29 Remote Code Execution via Authenticated File Upload

  Dotclear 2.29 contains a remote code execution vulnerability that allows authenticated attackers to upload malicious PHP files through the media upload functionality. Attackers can exploit the file upload process by crafting a PHP shell with a command executi…

  dotclear Dotclear dotclear Ubuntu
  Dec 10, 2025
• Medium 6.1
  CVE-2024-27626

  A Reflected Cross-Site Scripting (XSS) vulnerability has been identified in Dotclear version 2.29. The flaw exists with…

  dotclear Ubuntu
  Mar 5, 2024
• Unscored —
  CVE-2018-16358

  A cross-site scripting (XSS) vulnerability in inc/core/class.dc.core.php in the media manager in Dotclear through 2.14.…

  dotclear Ubuntu
  Sep 2, 2018
• Unscored —
  CVE-2018-5689

  Cross-site scripting (XSS) vulnerability in admin/auth.php in Dotclear 2.12.1 allows remote authenticated users to inje…

  dotclear Ubuntu
  Jan 14, 2018
• Unscored —
  CVE-2018-5690

  Cross-site scripting (XSS) vulnerability in admin/users.php in Dotclear 2.12.1 allows remote authenticated users to inj…

  dotclear Ubuntu
  Jan 14, 2018
• Unscored —
  CVE-2017-6446

  XSS was discovered in Dotclear v2.11.2, affecting admin/blogs.php and admin/users.php with the sortby and order paramet…

  dotclear Ubuntu
  Mar 5, 2017
• Unscored —
  CVE-2015-8831

  Cross-site scripting (XSS) vulnerability in admin/comments.php in Dotclear before 2.8.2 allows remote attackers to inje…

  dotclear Ubuntu
  Feb 9, 2017
• Unscored —
  CVE-2015-8832

  Multiple incomplete blacklist vulnerabilities in inc/core/class.dc.core.php in Dotclear before 2.8.2 allow remote authe…

  dotclear Ubuntu
  Feb 9, 2017
• Unscored —
  CVE-2016-7902

  Unrestricted file upload vulnerability in the fileUnzip->unzip method in Dotclear before 2.10.3 allows remote authentic…

  dotclear Ubuntu
  Jan 4, 2017
• Unscored —
  CVE-2016-7903

  Dotclear before 2.10.3, when the Host header is not part of the web server routing process, allows remote attackers to …

  dotclear Ubuntu
  Jan 4, 2017
• Unscored —
  CVE-2016-9891

  Cross-site scripting (XSS) vulnerability in admin/media.php and admin/media_item.php in Dotclear before 2.11 allows rem…

  dotclear Ubuntu
  Dec 29, 2016
• Unscored —
  CVE-2015-5651

  Cross-site scripting (XSS) vulnerability in Dotclear before 2.8.1 allows remote attackers to inject arbitrary web scrip…

  dotclear Ubuntu
  Oct 3, 2015