CVE-2018-16358: Dotclear

Medium severity, CVSS 5.4. EPSS: 0.7% chance of exploitation in the next 30 days.

A cross-site scripting (XSS) vulnerability in inc/core/class.dc.core.php in the media manager in Dotclear through 2.14.1 allows remote authenticated users to upload HTML content containing an XSS payload with the file extension .ahtml.

Affected products

• Dotclear Dotclear: up to and including 2.14.1

Published 2018-09-02. Last modified 2026-06-17.