Description

Dotclear before 2.6.2 allows remote attackers to execute arbitrary PHP code via a serialized object in the dc_passwd cookie to a password-protected page, which is not properly handled by (1) inc/public/lib.urlhandlers.php or (2) plugins/pages/_public.php.

Remediation

References

CVE-2014-1613

Related Vulnerabilities

WordPress Plugin Automated Content for Real Estate Multiple Unspecified Vulnerabilities (5.4.2)

Dolibarr Improper Privilege Management Vulnerability (CVE-2020-14201)

WordPress Plugin EWWW Image Optimizer Cloud Cross-Site Scripting (2.0.1)

Craft CMS Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') Vulnerability (CVE-2023-40035)

WordPress Plugin Duplicate Page Unspecified Vulnerability (3.5)

Severity

High

Classification

CVE-2014-1613 CWE-94

Tags

Missing Update Known Vulnerabilities