Description
Multiple cross-site scripting (XSS) vulnerabilities in Dotclear before 2.4.2 allow remote attackers to inject arbitrary web script or HTML via the (1) login_data parameter to admin/auth.php; (2) nb parameter to admin/blogs.php; (3) type, (4) sortby, (5) order, or (6) status parameters to admin/comments.php; or (7) page parameter to admin/plugin.php.
Remediation
References
Related Vulnerabilities
MySQL CVE-2014-6491 Vulnerability (CVE-2014-6491)
WordPress Plugin Themify Portfolio Post Cross-Site Scripting (1.1.9)
WordPress Plugin Banner Effect Header Cross-Site Request Forgery (1.2.6)
Drupal Core 9.2.x Cross-Site Scripting (9.2.0 - 9.2.10)
WordPress Plugin SP Project & Document Manager Arbitrary File Upload (4.22)