Description

Cross-site scripting (XSS) vulnerability in admin/media.php and admin/media_item.php in Dotclear before 2.11 allows remote authenticated users to inject arbitrary web script or HTML via the upfiletitle or media_title parameter (aka the media title).

Remediation

References

CVE-2016-9891

Related Vulnerabilities

MySQL CVE-2015-0381 Vulnerability (CVE-2015-0381)

WordPress Plugin WordLift-AI powered SEO-Schema Cross-Site Scripting (3.37.1)

WordPress Plugin WP Page Builder Cross-Site Scripting (1.2.8)

Jboss EAP Out-of-bounds Read Vulnerability (CVE-2019-0210)

WordPress Plugin Bug Library Unspecified Vulnerability (2.0.7)

Severity

Medium

Classification

CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Tags

Missing Update Known Vulnerabilities CWE-707 CVE-2016-9891