CVE-2016-9891

MEDIUM 5.4CVE-2016-9891 · Published 29/12/2016 · updated 17/06/2026

In short

CVE-2016-9891 is a MEDIUM (CVSS 5.4) vulnerability affecting dotclear (dotclear).
Chance of exploitation in the next 30 days (EPSS): 0.96%, higher than 61.6% of all vulnerabilities.
No patched version is listed yet: follow the vendor's advisory in References.

Package	Affected versions	Patched versions
dotclear dotclear	`≤ 2.10.4`	No fix yet

Description

Cross-site scripting (XSS) vulnerability in admin/media.php and admin/media_item.php in Dotclear before 2.11 allows remote authenticated users to inject arbitrary web script or HTML via the upfiletitle or media_title parameter (aka the media title).

References

securityfocus.com/bid/95156 · Third Party Advisory
dev.dotclear.org/2.0/changeset/5536ac77e915 · Issue Tracking
dev.dotclear.org/2.0/ticket/2224 · Issue Tracking
dotclear.org/blog/post/2016/12/28/Dotclear-2.11 · Release Notes
hg.dotclear.org/dotclear/rev/712559193a6e · Release Notes
smarterbitbybit.com/cve-2016-9891-dotclear-xss-vulnerability-in-version-2-10-4 · Third Party Advisory

More vulnerabilities in dotclear

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

dotclear

≤ 2.10.4

No fix yet

More vulnerabilities in dotclear

See all →