CVE-2014-3782
Multiple incomplete blacklist vulnerabilities in the filemanager::isFileExclude method in the Media Manager in Dotclear before 2.6.3 allow remote authenticated users to execute arbitrary PHP code by uploading a file with a (1) double extension or (2) .php5, (3) .phtml, or some other PHP file extension.
Ver en NVDSeveridad
N/A
EPSS
Probabilidad de explotación (próx. 30 días): 0.0083 (0.8%)
Percentil: 74.6%
EPSS: 2026-05-06
Afecta
dotclear:dotclearDescripción técnica
Multiple incomplete blacklist vulnerabilities in the filemanager::isFileExclude method in the Media Manager in Dotclear before 2.6.3 allow remote authenticated users to execute arbitrary PHP code by uploading a file with a (1) double extension or (2) .php5, (3) .phtml, or some other PHP file extension.
Publicada: 11/6/2014, 14:55:08
Última modificación: 6/5/2026, 22:30:45
Referencias
- http://dotclear.org/blog/post/2014/05/16/Dotclear-2.6.3
- http://karmainsecurity.com/KIS-2014-06
- http://seclists.org/fulldisclosure/2014/May/108
- http://seclists.org/fulldisclosure/2014/May/116
- http://seclists.org/fulldisclosure/2014/May/122
- http://secunia.com/advisories/58675
- http://dotclear.org/blog/post/2014/05/16/Dotclear-2.6.3
- http://karmainsecurity.com/KIS-2014-06