UBUNTU-CVE-2019-1010016

Dolibarr 6.0.4 is affected by: Cross Site Scripting XSS. The impact is: Cookie stealing. The component is: htdocs/product/stats/card.php. The attack vector is: Victim must click a specially crafted link sent by the attacker...

CVE-2019-1010016

Dolibarr 6.0.4 is affected by: Cross Site Scripting XSS. The impact is: Cookie stealing. The component is: htdocs/product/stats/card.php. The attack vector is: Victim must click a specially crafted link sent by the attacker...

CVE-2019-1010016

Dolibarr 6.0.4 is affected by: Cross Site Scripting XSS. The impact is: Cookie stealing. The component is: htdocs/product/stats/card.php. The attack vector is: Victim must click a specially crafted link sent by the attacker...

CVE-2019-1010016

CVE-2019-1010016 affects Dolibarr 6.0.4 with a Cross-Site Scripting (XSS) vulnerability in the file htdocs/product/stats/card.php. The attack requires a victim to click a specially crafted link sent by the attacker, which can lead to cookie stealing. The provided documents confirm the vulnerable ...

Cross-Site Scripting (XSS)

dolibarr is vulnerable to cross-site scripting XSS. The vulnerability is possible as it does not sanitize the employee parameter in user/card.php, which would allow a remote attacker to inject arbitrary Javascript into a victim's browser...

SQL Injection

dolibarr/dolibarr is vulnerable to SQL injection. A lack of validation on the desiredstock parameter in product/card.php allows a remote authenticated attacker to execute arbitrary SQL commands via an error-based SQL injection vulnerability. This vulnerability could potentially allow for remote...

CVE-2018-19995

A stored cross-site scripting XSS vulnerability in Dolibarr 8.0.2 allows remote authenticated users to inject arbitrary web script or HTML via the "address" POST or "town" POST parameter to user/card.php...

CVE-2018-19995

A stored cross-site scripting XSS vulnerability in Dolibarr 8.0.2 allows remote authenticated users to inject arbitrary web script or HTML via the "address" POST or "town" POST parameter to user/card.php...

CVE-2018-19998

SQL injection vulnerability in user/card.php in Dolibarr version 8.0.2 allows remote authenticated users to execute arbitrary SQL commands via the employee parameter...

CVE-2018-19998

SQL injection vulnerability in user/card.php in Dolibarr version 8.0.2 allows remote authenticated users to execute arbitrary SQL commands via the employee parameter...

CVE-2018-19998

Dolibarr 8.0.2 contains a SQL injection in user/card.php via the employee parameter, allowing remote authenticated users to execute arbitrary SQL commands. This is reported across multiple feeds (NVD/OSV/CNVD), with CVSS scores up to 8.8 (HIGH) and impact on confidentiality, integrity, and availa...

Sql injection

A SQL injection was discovered in WUZHI CMS 4.1.0 in coreframe/app/coupon/admin/card.php via the groupname parameter to the /index.php?m=coupon&f=card&v=detaillisting URI...

SQL Injection

Dolibarr ERP/CRM is vulnerable to SQL injection attacks. An attacker is able to execute arbitrary SQL commands via the statutbuy in parameter in product/card.php...

SQL Injection

dolibarr/dolibarr is vulnerable to SQL Injection attacks. The application does not properly sanitize the statusbatch parameter in product/card.php, allowing a malicious user to inject and execute arbitrary SQL commands...

SQL Injection

dolibarr/dolibarr is vulnerable to SQL Injection attacks. The application does not properly sanitize the statutbuy parameter in product/card.php, allowing a malicious user to inject and execute arbitrary SQL commands...

SQL Injection

dolibarr/dolibarr is vulnerable to SQL Injection attacks. The application does not properly sanitize the statut parameter in product/card.php, allowing a malicious user to inject and execute arbitrary SQL commands...

CVE-2018-13448

Dolibarr ERP/CRM 7.0.3 is affected by an SQL injection in product/card.php via the country_id parameter, enabling remote arbitrary SQL execution. The issue is confirmed across multiple sources (NVD entry CVE-2018-13448, OSV/Ubuntu/Nessus references) and is categorized with a high/severe impact (C...

CVE-2017-9839

Dolibarr ERP/CRM is affected by SQL injection in versions before 5.0.4 via product/stats/card.php type parameter...

CVE-2017-9838

Dolibarr ERP/CRM is affected by multiple reflected Cross-Site Scripting XSS vulnerabilities in versions before 5.0.4: index.php leftmenu parameter, core/ajax/box.php PATHINFO, product/stats/card.php type parameter, holiday/list.php monthcreate, monthstart, and monthend parameters, and don/card.ph...

Sql injection

Dolibarr ERP/CRM is affected by SQL injection in versions before 5.0.4 via product/stats/card.php type parameter...