HTB23074: Multiple XSS in Dotclear

Dotclear version 2.4.1.2 suffers from a cross site scripting vulnerabilities:
1. XSS in "login_data" POST parameter ("/admin/auth.php" script).
2. XSS in "nb" GET parameter to "/admin/blogs.php"; "type", "sortby", "order", "status" GET parameters to "/admin/comments.php"; "page" GET parameter to "/admin/plugin.php" scripts.

This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site.

Vulnerability ID: HTB23074
Vendor Notification / Vendor Patch / Public Disclosure: 8 February / 9 February / 29 February
Vulnerable Version(s): 2.4.1.2 and probably prior
Vulnerabilities Type: Cross Site Scripting (XSS)
Risk level: Medium

Also You can see all Security Advisories by High-Tech Bridge SA Security Research Lab.