Description

Cross-site scripting (XSS) vulnerability in admin/media.php and admin/media_item.php in Dotclear before 2.11 allows remote authenticated users to inject arbitrary web script or HTML via the upfiletitle or media_title parameter (aka the media title).

Remediation

References

CVE-2016-9891

Related Vulnerabilities

Oracle Application Server Other Vulnerability (CVE-2005-1383)

PHP version older than 4.3.8

WordPress Plugin Church Admin Arbitrary File Upload (4.4.6)

WordPress Plugin Localize My Post Local File Inclusion (1.0)

Apache Tomcat Permissions, Privileges, and Access Controls Vulnerability (CVE-2012-5885)

Severity

Medium

Classification

CVE-2016-9891 CWE-707 CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Tags

Missing Update Known Vulnerabilities