Vulnerabilities > Dotclear > Dotclear > 2.11.2
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2018-09-02 | CVE-2018-16358 | Cross-site Scripting vulnerability in Dotclear A cross-site scripting (XSS) vulnerability in inc/core/class.dc.core.php in the media manager in Dotclear through 2.14.1 allows remote authenticated users to upload HTML content containing an XSS payload with the file extension .ahtml. | 3.5 |
| 2017-03-05 | CVE-2017-6446 | Cross-site Scripting vulnerability in Dotclear 2.11.2 XSS was discovered in Dotclear v2.11.2, affecting admin/blogs.php and admin/users.php with the sortby and order parameters. | 4.3 |