GCVE - cpe:2.3:a:dotclear:dotclear:1.2.8:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:dotclear:dotclear:1.2.8:*:*:*:*:*:*:*

part: a version: 1.2.8 update: *

Vendor	Dotclear (`572f9c5b-c8b3-527c-9715-53310878ae99`)
Product	Dotclear (`0e191e6c-d0ec-5ad4-809b-fa2a66fde3cc`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*

Notes

Imported from NVD CPE 2.0 feed

PURL mappings

PURL	Source	Last updated
`pkg:github/dotclear/dotclear`	purl2cpe	2026-06-01 10:11:04.866585

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2014-3783`	vulnerable	2026-06-08 05:05:42.700172	Details available SQL injection vulnerability in admin/categories.php in Dotclear before 2.6.3 allows remote authenticated users with the manage categories permission to execute arbitrary SQL commands via the categories_order parameter. Published: 2014-05-22T15:00:00.000Z Updated: 2024-08-06T10:57:17.130Z Open on db.gcve.eu Reference links http://dotclear.org/blog/post/2014/05/16/Dotclear-2.6.3 http://packetstormsecurity.com/files/126768/Dotclear-2.6.2-SQL-Injection.html http://karmainsecurity.com/KIS-2014-07 http://www.securityfocus.com/archive/1/532185/100/0/threaded http://seclists.org/fulldisclosure/2014/May/109	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2012-1039`	vulnerable	2026-06-08 05:00:47.220273	Details available Multiple cross-site scripting (XSS) vulnerabilities in Dotclear before 2.4.2 allow remote attackers to inject arbitrary web script or HTML via the (1) login_data parameter to admin/auth.php; (2) nb parameter to admin/blogs.php; (3) type, (4) sortby, (5) order, or (6) status parameters to admin/comments.php; or (7) page parameter to admin/plugin.php. Published: 2012-03-19T19:00:00.000Z Updated: 2024-08-06T18:45:27.153Z Open on db.gcve.eu Reference links https://www.htbridge.ch/advisory/HTB23074 http://dotclear.org/blog/post/2012/02/11/Dotclear-2.4.2 https://exchange.xforce.ibmcloud.com/vulnerabilities/73565 http://www.securityfocus.com/bid/52221 http://archives.neohapsis.com/archives/bugtraq/2012-02/0183.html	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2011-1584`	vulnerable	2026-06-08 04:58:00.745652	Details available The updateFile function in inc/core/class.dc.media.php in the Media Manager in Dotclear before 2.2.3 does not properly restrict pathnames, which allows remote authenticated users to upload and execute arbitrary PHP code via the media_path or media_file parameter. NOTE: some of these details are obtained from third party information. Published: 2011-06-08T10:00:00.000Z Updated: 2024-09-17T00:35:48.193Z Open on db.gcve.eu Reference links http://openwall.com/lists/oss-security/2011/04/13/19 http://openwall.com/lists/oss-security/2011/04/15/7 http://openwall.com/lists/oss-security/2011/04/15/11 http://fr.dotclear.org/blog/post/2011/04/01/Dotclear-2.2.3 http://dotclear.org/blog/post/2011/04/01/Dotclear-2.2.3	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2009-0933`	vulnerable	2026-06-08 04:51:12.253660	Details available Cross-site scripting (XSS) vulnerability in the administrative interface in Dotclear before 2.1.5 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. Published: 2009-03-17T22:00:00.000Z Updated: 2024-08-07T04:57:17.573Z Open on db.gcve.eu Reference links https://exchange.xforce.ibmcloud.com/vulnerabilities/49138 http://dotclear.org/blog/post/2009/02/05/Dotclear-2.1.5 http://www.vupen.com/english/advisories/2009/0636 http://secunia.com/advisories/34181 http://www.securityfocus.com/bid/34036	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.

DotClear 1.2.8

Notes

PURL mappings

Vulnerability references

Contribute