CVE-2018-16358

5.4 mediumEPSS 0.7%

Medium (5.4) in dotclear dotclear. EPSS 0.7% chance of exploitation in the next 30 days.

A cross-site scripting (XSS) vulnerability in inc/core/class.dc.core.php in the media manager in Dotclear through 2.14.1 allows remote authenticated users to upload HTML content containing an XSS payload with the file extension .ahtml.

Severity

CVSS 3.0

5.4 medium

CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

EPSS: 0.7% chance of exploitation in the next 30 days; higher than 52% of CVEs (scores of 2026-10-31)
CWE: CWE-79
Published: 2018-09-02
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

dotclear:dotclear

References

https://hg.dotclear.org/dotclear/rev/d4841d6d65d6
https://hg.dotclear.org/dotclear/rev/d4841d6d65d6

Check your stack JSON