CVE-2012-1039

Published: Mar 19, 2012Modified: Apr 29, 2026

4.3

Vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Exploitability: 8.6 / Impact: 2.9

Source: NVD

Description

Multiple cross-site scripting (XSS) vulnerabilities in Dotclear before 2.4.2 allow remote attackers to inject arbitrary web script or HTML via the (1) login_data parameter to admin/auth.php; (2) nb parameter to admin/blogs.php; (3) type, (4) sortby, (5) order, or (6) status parameters to admin/comments.php; or (7) page parameter to admin/plugin.php.

Affected (33)

Products: Dotclear: Dotclear

Dotclear

1 product

Dotclear

Configuration A

33 vulnerable

Vulnerable Software	Affected Versions
Dotclear Dotclear	Up to 2.3.1
Dotclear Dotclear	Version 1.2.1
Dotclear Dotclear	Version 1.2.2
Dotclear Dotclear	Version 1.2.3
Dotclear Dotclear	Version 1.2.4
Dotclear Dotclear	Version 1.2.5
Dotclear Dotclear	Version 1.2.6
Dotclear Dotclear	Version 1.2.7
Dotclear Dotclear	Version 1.2.8
Dotclear Dotclear	Version 2.0.1
Dotclear Dotclear	Version 2.0.2
Dotclear Dotclear	Version 2.0
Dotclear Dotclear	Version 2.0 beta_2
Dotclear Dotclear	Version 2.0 beta_3
Dotclear Dotclear	Version 2.0 beta_4
Dotclear Dotclear	Version 2.0 beta_5.2
Dotclear Dotclear	Version 2.0 beta_5.4
Dotclear Dotclear	Version 2.0 beta_6
Dotclear Dotclear	Version 2.0 beta_7
Dotclear Dotclear	Version 2.0 rc1
Dotclear Dotclear	Version 2.0 rc2
Dotclear Dotclear	Version 2.1.1
Dotclear Dotclear	Version 2.1.3
Dotclear Dotclear	Version 2.1.4
Dotclear Dotclear	Version 2.1.5
Dotclear Dotclear	Version 2.1.6
Dotclear Dotclear	Version 2.1.7
Dotclear Dotclear	Version 2.1
Dotclear Dotclear	Version 2.2.1
Dotclear Dotclear	Version 2.2.2
Dotclear Dotclear	Version 2.2.3
Dotclear Dotclear	Version 2.2
Dotclear Dotclear	Version 2.3.0