2.10.3

DATE	CVE	VULNERABILITY TITLE	RISK
2018-09-02	CVE-2018-16358	Cross-site Scripting vulnerability in Dotclear A cross-site scripting (XSS) vulnerability in inc/core/class.dc.core.php in the media manager in Dotclear through 2.14.1 allows remote authenticated users to upload HTML content containing an XSS payload with the file extension .ahtml. network dotclear CWE-79	3.5
2016-12-29	CVE-2016-9891	Cross-site Scripting vulnerability in Dotclear Cross-site scripting (XSS) vulnerability in admin/media.php and admin/media_item.php in Dotclear before 2.11 allows remote authenticated users to inject arbitrary web script or HTML via the upfiletitle or media_title parameter (aka the media title). network dotclear CWE-79	3.5
2016-11-10	CVE-2016-9268	Unrestricted Upload of File with Dangerous Type vulnerability in Dotclear Unrestricted file upload vulnerability in the Blog appearance in the "Install or upgrade manually" module in Dotclear through 2.10.4 allows remote authenticated super-administrators to execute arbitrary code by uploading a theme file with an zip extension, and then accessing it via unspecified vectors. network low complexity dotclear CWE-434 critical	9.0