Description
Multiple incomplete blacklist vulnerabilities in inc/core/class.dc.core.php in Dotclear before 2.8.2 allow remote authenticated users with "manage their own media items" and "manage their own entries and comments" permissions to execute arbitrary PHP code by uploading a file with a (1) .pht, (2) .phps, or (3) .phtml extension.
Remediation
References
Related Vulnerabilities
WordPress Plugin Photoswipe Masonry Gallery Unspecified Vulnerability (1.2.17)
Liferay DXP Authorization Bypass Through User-Controlled Key Vulnerability (CVE-2025-62244)
Jboss EAP Cryptographic Issues Vulnerability (CVE-2012-5575)
MySQL CVE-2017-3318 Vulnerability (CVE-2017-3318)
WordPress Plugin Easy Property Listings Unspecified Vulnerability (2.0)