CVE-2026-89013

CVE-2026-89013 — Обход авторизации в Dolibarr через hashp=shared Эксплойт для CVE-2026-89013: document.php и viewimage.php принудительно устанавливают NOLOGIN, когда присутствует параметр hashp. Внутреннее маркерное значение shared пропускает разрешение share-токена, но переопределение контроля...

Dolibarr < 24.0.0 - Authorization Bypass via hashp Parameter

Dolibarr ERP/CRM versions 23.0.4 through 24.0.0 contain an authorization bypass vulnerability in document.php and viewimage.php. The public share-link feature forces NOLOGIN when hashp is present, but the value 'shared' skips token resolution while the override still fires for any non-empty hashp...

VulnCheck KEV: CVE-2026-89013

Dolibarr 23.0.4 before 24.0.1 contains an authorization bypass vulnerability that allows unauthenticated attackers to read arbitrary files through the document storage endpoints by supplying a crafted hashp parameter value. Attackers can send a request with hashp=shared to skip token validation...

Exploit for CVE-2026-89013

CVE-2026-89013 — Dolibarr hashp=shared Authorization Bypass E...

CVE-2026-89013 Dolibarr 23.0.4 < 24.0.1 Authorization Bypass via hashp Parameter in document.php

Dolibarr 23.0.4 before 24.0.1 contains an authorization bypass vulnerability that allows unauthenticated attackers to read arbitrary files through the document storage endpoints by supplying a crafted hashp parameter value. Attackers can send a request with hashp=shared to skip token validation...

CVE-2026-89013 Dolibarr 23.0.4 < 24.0.1 Authorization Bypass via hashp Parameter in document.php

Dolibarr 23.0.4 before 24.0.1 contains an authorization bypass vulnerability that allows unauthenticated attackers to read arbitrary files through the document storage endpoints by supplying a crafted hashp parameter value. Attackers can send a request with hashp=shared to skip token validation...

CVE-2026-89013

Dolibarr 23.0.4 through 24.0.0 contains an authorization bypass in htdocs/document.php and htdocs/viewimage.php that allows unauthenticated attackers to read arbitrary files within the application's managed directories. The root cause is a regression (commit 5028dae981e, shipped in 23.0.4): suppl...

EUVD-2020-23651

Malware in sbrugna...

EUVD-2020-10379

Malware in sbrugna...

EUVD-2022-4732

Malicious code in bioql PyPI...

CVE-2024-30920

Cross Site Scripting vulnerability in DerbyNet v9.0 and below allows a remote attacker to execute arbitrary code via the render-document.php component...

CVE-2020-18455

Cross Site Scripting XSS vulnerability exists in bycms v3.0.4 via the title parameter in the edit function in Document.php...

CVE-2024-30920

Cross Site Scripting vulnerability in DerbyNet v9.0 and below allows a remote attacker to execute arbitrary code via the render-document.php component...

CVE-2024-30920

Cross Site Scripting vulnerability in DerbyNet v9.0 and below allows a remote attacker to execute arbitrary code via the render-document.php component...

CVE-2024-30920

A Cross-Site Scripting (XSS) vulnerability exists in DerbyNet v9.0 and below within the render-document.php component. The root cause is the application's failure to properly sanitize user input in document rendering paths, specifically when displaying debug information such as ORIG_SCRIPT_FILENA...

CVE-2024-30920: Improper Neutralization of Input During Web Page Generation

Cross Site Scripting vulnerability in DerbyNet v9.0 and below allows a remote attacker to execute arbitrary code via the render-document.php component...

CVE-2020-36073

SQL injection vulnerability found in Tailor Management System v.1 allows a remote attacker to execute arbitrary code via the detail parameter of the document.php page...

CVE-2020-36073

SQL injection vulnerability found in Tailor Management System v.1 allows a remote attacker to execute arbitrary code via the detail parameter of the document.php page...

CVE-2020-36073: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability found in Tailor Management System v.1 allows a remote attacker to execute arbitrary code via the detail parameter of the document.php page...

CVE-2020-18455

Cross Site Scripting XSS vulnerability exists in bycms v3.0.4 via the title parameter in the edit function in Document.php...