CVE-2014-3783: Dotclear

Medium severity, CVSS 6.0. EPSS: 1.7% chance of exploitation in the next 30 days.

SQL injection vulnerability in admin/categories.php in Dotclear before 2.6.3 allows remote authenticated users with the manage categories permission to execute arbitrary SQL commands via the categories_order parameter.

Affected products

• Dotclear Dotclear: up to and including 2.6.2; version 1.2.1 only; version 1.2.2 only; version 1.2.3 only; version 1.2.4 only; version 1.2.5 only; …

Published 2014-05-22. Last modified 2026-06-17.