Unrated severityNVD Advisory· Published Jul 11, 2007· Updated Jun 16, 2026

CVE-2007-3688

Description

Multiple cross-site request forgery (CSRF) vulnerabilities in DotClear 1.2.6 allow remote attackers to perform actions as arbitrary users via the (1) tool_url parameter to ecrire/tools.php and multiple fields on the (2) blogconf, (3) blogroll, (4) ecrire/redacteur.php, and (5) ecrire/user_prefs.php pages.

Affected products

Dotclear/Dotclear2 versions
cpe:2.3:a:dotclear:dotclear:1.2.6:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:dotclear:dotclear:1.2.6:*:*:*:*:*:*:*
- (no CPE)range: = 1.2.6

Patches

Vulnerability mechanics

References

secunia.com/advisories/25971nvdVendor Advisory
ar3av.free.fr/faille-dotclear.phpnvd
archives.neohapsis.com/archives/bugtraq/2007-07/0102.htmlnvd
osvdb.org/37891nvd
osvdb.org/37892nvd
osvdb.org/37893nvd
exchange.xforce.ibmcloud.com/vulnerabilities/35324nvd

News mentions

No linked articles in our index yet.

cvss	0.000
epss	0.001
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000