Dotclear Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2016-9891)

Description

Cross-site scripting (XSS) vulnerability in admin/media.php and admin/media_item.php in Dotclear before 2.11 allows remote authenticated users to inject arbitrary web script or HTML via the upfiletitle or media_title parameter (aka the media title).

Remediation

References

CVE-2016-9891

Related Vulnerabilities

WordPress Plugin Contact Form for WordPress-Ultimate Form Builder Lite Cross-Site Scripting (1.3.3)

WordPress Plugin GA Universal Cross-Site Request Forgery (1.0)

WordPress Plugin Font Awesome Information Disclosure (4.0.0-rc16)

WordPress Plugin YaMaps for WordPress Cross-Site Scripting (0.6.25)

ReviveAdserver Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2016-9472)

Severity

Medium

Classification

CVE-2016-9891 CWE-707 CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N