CVE-2026-71503

Dolibarr before 24.0.0 contains a reflected cross-site scripting vulnerability in the extra fields administration template where the type request parameter is echoed without JavaScript-context encoding into an inline script block and no Content-Security-Policy header is emitted. An unauthenticate...

PT-2026-80998

Name of the Vulnerable Software and Affected Versions Dolibarr versions prior to 24.0.0 Description A reflected cross-site scripting issue exists in the extra fields administration template. The type request parameter is echoed into an inline script block without proper JavaScript-context encodin...