Unrated
Cross-site scripting (XSS) vulnerability in admin/media.php and admin/media_item.php in Dotclear before 2.11 allows remote authenticated users to inje...
CVE-2016-9891
First seen on SecPulse
Original description The description as published by the source.
Cross-site scripting (XSS) vulnerability in admin/media.php and admin/media_item.php in Dotclear before 2.11 allows remote authenticated users to inject arbitrary web script or HTML via the upfiletitle or media_title parameter (aka the media title).
References
- advisory securityfocus.com
- advisory dotclear.org
- advisory hg.dotclear.org
- advisory smarterbitbybit.com
- patch dev.dotclear.org
- report dev.dotclear.org