CVE-2016-9268

Unrestricted file upload vulnerability in the Blog appearance in the "Install or upgrade manually" module in Dotclear through 2.10.4 allows remote authenticated super-administrators to execute arbitrary code by uploading a theme file with an zip extension, and then accessing it via unspecified vectors.

• CWE-434

• http://dev.dotclear.org/2.0/changeset/445e9ff79a1fa81033591761d6a340e219d159b2Issue Tracking, Patch
• http://dev.dotclear.org/2.0/ticket/2214Mitigation, Vendor Advisory
• http://www.securityfocus.com/bid/94246Third Party Advisory, VDB Entry
• http://dev.dotclear.org/2.0/changeset/445e9ff79a1fa81033591761d6a340e219d159b2Issue Tracking, Patch
• http://dev.dotclear.org/2.0/ticket/2214Mitigation, Vendor Advisory
• http://www.securityfocus.com/bid/94246Third Party Advisory, VDB Entry

Published

Nov 10, 2016

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2016-9261Cross-site scripting (XSS) vulnerability in Tenable Log Corr…5.4
• CVE-2016-9262Multiple integer overflows in the (1) jas_realloc function i…
• CVE-2016-9263WordPress through 4.8.2, when domain-based flashmediaelement…
• CVE-2016-9264Buffer overflow in the printMP3Headers function in listmp3.c…
• CVE-2016-9265The printMP3Headers function in listmp3.c in Libming 0.4.7 a…
• CVE-2016-9266listmp3.c in libming 0.4.7 allows remote attackers to unspec…
• CVE-2016-9269Remote Command Execution in com.trend.iwss.gui.servlet.Manag…
• CVE-2016-9271Cloudera Manager 5.7.x before 5.7.6, 5.8.x before 5.8.4, and…5.4
• CVE-2016-9272A Blind SQL Injection Vulnerability in Exponent CMS through …
• CVE-2016-9273tiffsplit in libtiff 4.0.6 allows remote attackers to cause …
• CVE-2016-9274Untrusted search path vulnerability in Git 1.x for Windows a…7.8
• CVE-2016-9275Heap-based buffer overflow in the _dwarf_skim_forms function…7.5