GCVE - cpe:2.3:a:dotclear:dotclear:2.6.1:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:dotclear:dotclear:2.6.1:*:*:*:*:*:*:*

part: a version: 2.6.1 update: *

Vendor	Dotclear (`572f9c5b-c8b3-527c-9715-53310878ae99`)
Product	Dotclear (`0e191e6c-d0ec-5ad4-809b-fa2a66fde3cc`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*

Notes

Imported from NVD CPE 2.0 feed

PURL mappings

PURL	Source	Last updated
`pkg:github/dotclear/dotclear`	purl2cpe	2026-06-01 10:11:04.866658

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2014-5316`	vulnerable	2026-06-08 05:05:47.524887	Details available Cross-site scripting (XSS) vulnerability in Dotclear before 2.6.4 allows remote attackers to inject arbitrary web script or HTML via a crafted page. Published: 2014-09-22T01:00:00.000Z Updated: 2024-08-06T11:41:48.317Z Open on db.gcve.eu Reference links http://jvn.jp/en/jp/JVN61637002/index.html http://www.securityfocus.com/bid/69985 http://jvndb.jvn.jp/jvndb/JVNDB-2014-000110 http://dotclear.org/blog/post/2014/08/18/Dotclear-2.6.4	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2014-3783`	vulnerable	2026-06-08 05:05:42.717498	Details available SQL injection vulnerability in admin/categories.php in Dotclear before 2.6.3 allows remote authenticated users with the manage categories permission to execute arbitrary SQL commands via the categories_order parameter. Published: 2014-05-22T15:00:00.000Z Updated: 2024-08-06T10:57:17.130Z Open on db.gcve.eu Reference links http://dotclear.org/blog/post/2014/05/16/Dotclear-2.6.3 http://packetstormsecurity.com/files/126768/Dotclear-2.6.2-SQL-Injection.html http://karmainsecurity.com/KIS-2014-07 http://www.securityfocus.com/archive/1/532185/100/0/threaded http://seclists.org/fulldisclosure/2014/May/109	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2014-3782`	vulnerable	2026-06-08 05:05:42.693723	Details available Multiple incomplete blacklist vulnerabilities in the filemanager::isFileExclude method in the Media Manager in Dotclear before 2.6.3 allow remote authenticated users to execute arbitrary PHP code by uploading a file with a (1) double extension or (2) .php5, (3) .phtml, or some other PHP file extension. Published: 2014-06-11T14:00:00.000Z Updated: 2024-08-06T10:57:17.756Z Open on db.gcve.eu Reference links http://dotclear.org/blog/post/2014/05/16/Dotclear-2.6.3 http://seclists.org/fulldisclosure/2014/May/122 http://seclists.org/fulldisclosure/2014/May/116 http://secunia.com/advisories/58675 http://karmainsecurity.com/KIS-2014-06	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2014-3781`	vulnerable	2026-06-08 05:05:42.693204	Details available The dcXmlRpc::setUser method in nc/core/class.dc.xmlrpc.php in Dotclear before 2.6.3 allows remote attackers to bypass authentication via an empty password in an XML-RPC request. Published: 2014-06-11T14:00:00.000Z Updated: 2024-08-06T10:57:17.406Z Open on db.gcve.eu Reference links http://dotclear.org/blog/post/2014/05/16/Dotclear-2.6.3 http://seclists.org/fulldisclosure/2014/May/107 http://secunia.com/advisories/58675 http://packetstormsecurity.com/files/126766/Dotclear-2.6.2-Authentication-Bypass.html http://karmainsecurity.com/KIS-2014-05	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.

DotClear 2.6.1

Notes

PURL mappings

Vulnerability references

Contribute