CVE-2014-3783

Severity: medium (CVSS 6.0 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.7% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2014-05-22 · updated 2026-06-17
Weakness: CWE-89

Description

SQL injection vulnerability in admin/categories.php in Dotclear before 2.6.3 allows remote authenticated users with the manage categories permission to execute arbitrary SQL commands via the categories_order parameter.

Affected products

Dotclear: through 2.6.2; 1.2.1, 1.2.2, 1.2.3, 1.2.4, 1.2.5, 1.2.6 (+37)

References

http://dotclear.org/blog/post/2014/05/16/Dotclear-2.6.3
http://karmainsecurity.com/KIS-2014-07
http://packetstormsecurity.com/files/126768/Dotclear-2.6.2-SQL-Injection.html
http://seclists.org/fulldisclosure/2014/May/109
http://www.securityfocus.com/archive/1/532185/100/0/threaded
http://dotclear.org/blog/post/2014/05/16/Dotclear-2.6.3
http://karmainsecurity.com/KIS-2014-07
http://packetstormsecurity.com/files/126768/Dotclear-2.6.2-SQL-Injection.html
http://seclists.org/fulldisclosure/2014/May/109
http://www.securityfocus.com/archive/1/532185/100/0/threaded

Get alerted when CVE-2014-3783 or the next vulnerability affects your stack