| Package | Affected versions | Patched versions |
|---|---|---|
| dotclear | = 1.2.1= 1.2.2= 1.2.3= 1.2.4= 1.2.5= 1.2.6= 1.2.7= 1.2.8= 2.0= 2.0.1= 2.0.2= 2.1= 2.1.1= 2.1.3= 2.1.4= 2.1.5= 2.1.6= 2.1.7= 2.2= 2.2.1= 2.2.2= 2.2.3= 2.3.0≤ 2.3.1 |
Multiple cross-site scripting (XSS) vulnerabilities in Dotclear before 2.4.2 allow remote attackers to inject arbitrary web script or HTML via the (1) login_data parameter to admin/auth.php; (2) nb parameter to admin/blogs.php; (3) type, (4) sortby, (5) order, or (6) status parameters to admin/comments.php; or (7) page parameter to admin/plugin.php.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free