Unrated severityNVD Advisory· Published Jun 11, 2014· Updated May 6, 2026

CVE-2014-3781

Description

The dcXmlRpc::setUser method in nc/core/class.dc.xmlrpc.php in Dotclear before 2.6.3 allows remote attackers to bypass authentication via an empty password in an XML-RPC request.

Affected products

Dotclear/Dotclear4 versions
cpe:2.3:a:dotclear:dotclear:*:*:*:*:*:*:*:*+ 3 more
- cpe:2.3:a:dotclear:dotclear:*:*:*:*:*:*:*:*range: <=2.6.2
- cpe:2.3:a:dotclear:dotclear:2.6:-:*:*:*:*:*:*
- cpe:2.3:a:dotclear:dotclear:2.6:rc:*:*:*:*:*:*
- cpe:2.3:a:dotclear:dotclear:2.6.1:*:*:*:*:*:*:*

Patches

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

karmainsecurity.com/KIS-2014-05nvdExploit
packetstormsecurity.com/files/126766/Dotclear-2.6.2-Authentication-Bypass.htmlnvdExploit
seclists.org/fulldisclosure/2014/May/107nvdExploit
dotclear.org/blog/post/2014/05/16/Dotclear-2.6.3nvdVendor Advisory
secunia.com/advisories/58675nvd

News mentions

No linked articles in our index yet.

cvss	0.000
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000