Avantune Genialcloud ProJ Cross-Site Scripting Vulnerability

Avantune Genialcloud ProJ is a cloud-based ERP platform from Avantune Canada. version 10 of Avantune Genialcloud ProJ is vulnerable to a cross-site scripting vulnerability that could be exploited by attackers to inject and execute arbitrary web scripts or HTML via a crafted payload...

Dolibarr ERP and CRM contain XSS Vulnerability

Dolibarr ERP and CRM 13.0.2 allows XSS via object details, as demonstrated by and characters in the onpointermove attribute of a BODY element to the user-management feature...

GHSA-FC6H-769X-GFF5 Dolibarr ERP and CRM contain XSS Vulnerability

Dolibarr ERP and CRM 13.0.2 allows XSS via object details, as demonstrated by and characters in the onpointermove attribute of a BODY element to the user-management feature...

Dolibarr ERP and CRM contain XSS Vulnerability

Dolibarr ERP/CRM before 10.0.3 allows XSS because uploaded HTML documents are served as text/html despite being renamed to .noexe files...

GHSA-JH3J-XFV2-F9M9 Dolibarr ERP and CRM SQLi

Dolibarr ERP/CRM before 10.0.3 allows SQL Injection...

Dolibarr ERP and CRM SQLi

Dolibarr ERP/CRM before 10.0.3 allows SQL Injection...

GHSA-GFHF-2XR5-2FVW Dolibarr ERP and CRM contain XSS Vulnerability

Dolibarr ERP/CRM before 10.0.3 has an Insufficient Filtering issue that can lead to user/card.php XSS...

Dolibarr ERP and CRM contain XSS Vulnerability

Dolibarr ERP/CRM before 10.0.3 has an Insufficient Filtering issue that can lead to user/card.php XSS...

GHSA-PM57-926C-28MR Dolibarr Cross-site Scripting via the qty parameter in product/fournisseurs.php

Dolibarr ERP/CRM 3.0 through 10.0.3 allows XSS via the qty parameter to product/fournisseurs.php product price screen...

Dolibarr Cross-site Scripting via the qty parameter in product/fournisseurs.php

Dolibarr ERP/CRM 3.0 through 10.0.3 allows XSS via the qty parameter to product/fournisseurs.php product price screen...

GHSA-87R3-4GC8-F897 Dolibarr ERP and CRM contain XSS Vulnerability

Dolibarr ERP/CRM before 10.0.3 allows XSS because uploaded HTML documents are served as text/html despite being renamed to .noexe files...

Dolibarr ERP and CRM contain XSS Vulnerability

Dolibarr 11.0 allows XSS via the joinfiles, topic, or code parameter, or the HTTP Referer header...

GHSA-JH69-6VV2-WFP5 Dolibarr ERP and CRM contain XSS Vulnerability

Dolibarr 11.0 allows XSS via the joinfiles, topic, or code parameter, or the HTTP Referer header...

GHSA-F6H3-66XR-HQR2 Dolibarr ERP and CRM contain XSS Vulnerability

Dolibarr CRM/ERP 10.0.3 allows viewimage.php?file= Stored XSS due to JavaScript execution in an SVG image for a profile picture...

Dolibarr ERP and CRM contain XSS Vulnerability

Dolibarr CRM/ERP 10.0.3 allows viewimage.php?file= Stored XSS due to JavaScript execution in an SVG image for a profile picture...

Dolibarr ERP and CRM HTML Injection

There is HTML Injection in the Note field in Dolibarr ERP/CRM 10.0.2 via user/note.php...

GHSA-3264-65PG-5XM4 Dolibarr ERP and CRM HTML Injection

There is HTML Injection in the Note field in Dolibarr ERP/CRM 10.0.2 via user/note.php...

Dolibarr ERP and CRM Code Injection

Dolibarr ERP/CRM 9.0.1 provides a module named website that provides for creation of public websites with a WYSIWYG editor. It was identified that the editor also allowed inclusion of dynamic code, which can lead to code execution on the host machine. An attacker has to check a setting on the sam...

Dolibarr ERP and CRM malicious executable loading

Dolibarr ERP/CRM 9.0.1 provides a web-based functionality that backs up the database content to a dump file. However, the application performs insufficient checks on the export parameters to mysqldump, which can lead to execution of arbitrary binaries on the server. Malicious binaries can be...

GHSA-JWG3-V9XM-V6Q9 Dolibarr ERP and CRM Code Injection

Dolibarr ERP/CRM 9.0.1 provides a module named website that provides for creation of public websites with a WYSIWYG editor. It was identified that the editor also allowed inclusion of dynamic code, which can lead to code execution on the host machine. An attacker has to check a setting on the sam...