CVE-2014-1613

no score yetEPSS 2.3%

dotclear dotclear: no CVSS score yet. EPSS 2.3% chance of exploitation in the next 30 days.

Dotclear before 2.6.2 allows remote attackers to execute arbitrary PHP code via a serialized object in the dc_passwd cookie to a password-protected page, which is not properly handled by (1) inc/public/lib.urlhandlers.php or (2) plugins/pages/_public.php.

EPSS: 2.3% chance of exploitation in the next 30 days; higher than 83% of CVEs (scores of 2026-10-31)
CWE: CWE-94
Published: 2014-05-16
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

dotclear:dotclear

References

http://dotclear.org/blog/post/2014/01/20/Dotclear-2.6.2
https://labs.mwrinfosecurity.com/advisories/2014/05/14/dotclear-php-object-injection/
http://dotclear.org/blog/post/2014/01/20/Dotclear-2.6.2
https://labs.mwrinfosecurity.com/advisories/2014/05/14/dotclear-php-object-injection/

Check your stack JSON