Cross site scripting

In htdocs/societe/card.php in Dolibarr 10.0.1, the value of the User-Agent HTTP header is copied into the HTML document as plain text between tags, leading to XSS...

CVE-2019-16197

CVE-2019-16197 affects Dolibarr 10.0.1, where the value of the HTTP User-Agent header is echoed into the HTML page in htdocs/societe/card.php, causing a reflected XSS. The vulnerability stems from copying header text between HTML tags, allowing potentially injected scripts to execute in the conte...

CVE-2019-16197

In htdocs/societe/card.php in Dolibarr 10.0.1, the value of the User-Agent HTTP header is copied into the HTML document as plain text between tags, leading to XSS...

PT-2019-14573 · Dolibarr · Dolibarr

Name of the Vulnerable Software and Affected Versions: Dolibarr version 10.0.1 Description: The issue concerns the copying of the User-Agent HTTP header value into an HTML document as plain text between tags, leading to a potential XSS issue. Recommendations: For Dolibarr version 10.0.1, consider...

CVE-2019-16197: Improper Neutralization of Input During Web Page Generation

In htdocs/societe/card.php in Dolibarr 10.0.1, the value of the User-Agent HTTP header is copied into the HTML document as plain text between tags, leading to XSS...

CVE-2019-15062: Cross-Site Request Forgery (CSRF)

An issue was discovered in Dolibarr 11.0.0-alpha. A user can store an IFRAME element containing a user/card.php CSRF request in his Linked Files settings page. When visited by the admin, this could completely take over the admin account. The protection mechanism for CSRF is to check the Referer...

Cross-site Scripting (XSS)

dolibarr/dolibarr is vulnerable to cross-site scripting XSS. The GETPOST functions in htdocs/product/stats/card.php for example for id parameter are not properly validated, allowing an attacker to inject an arbitrary script which will send a specifically crafted link to the user to steal users'...

CVE-2019-1010016

Dolibarr 6.0.4 is affected by: Cross Site Scripting XSS. The impact is: Cookie stealing. The component is: htdocs/product/stats/card.php. The attack vector is: Victim must click a specially crafted link sent by the attacker...

CVE-2019-1010016

Dolibarr 6.0.4 is affected by: Cross Site Scripting XSS. The impact is: Cookie stealing. The component is: htdocs/product/stats/card.php. The attack vector is: Victim must click a specially crafted link sent by the attacker...

Cross site scripting

Dolibarr 6.0.4 is affected by: Cross Site Scripting XSS. The impact is: Cookie stealing. The component is: htdocs/product/stats/card.php. The attack vector is: Victim must click a specially crafted link sent by the attacker...

CVE-2019-1010016

Dolibarr 6.0.4 is affected by: Cross Site Scripting XSS. The impact is: Cookie stealing. The component is: htdocs/product/stats/card.php. The attack vector is: Victim must click a specially crafted link sent by the attacker...

UBUNTU-CVE-2019-1010016

Dolibarr 6.0.4 is affected by: Cross Site Scripting XSS. The impact is: Cookie stealing. The component is: htdocs/product/stats/card.php. The attack vector is: Victim must click a specially crafted link sent by the attacker...

CVE-2019-1010016

CVE-2019-1010016 affects Dolibarr 6.0.4 with a Cross-Site Scripting (XSS) vulnerability in the file htdocs/product/stats/card.php. The attack requires a victim to click a specially crafted link sent by the attacker, which can lead to cookie stealing. The provided documents confirm the vulnerable ...

CVE-2019-1010016

Dolibarr 6.0.4 is affected by: Cross Site Scripting XSS. The impact is: Cookie stealing. The component is: htdocs/product/stats/card.php. The attack vector is: Victim must click a specially crafted link sent by the attacker...

CVE-2019-1010016: Improper Neutralization of Input During Web Page Generation

Dolibarr 6.0.4 is affected by: Cross Site Scripting XSS. The impact is: Cookie stealing. The component is: htdocs/product/stats/card.php. The attack vector is: Victim must click a specially crafted link sent by the attacker...

CVE-2018-16809: Improper Neutralization of Special Elements used in an SQL Command

An issue was discovered in Dolibarr through 7.0.0. expensereport/card.php in the expense reports module allows SQL injection via the integer parameters qty and valueunit...

CVE-2018-16808: Improper Neutralization of Input During Web Page Generation

An issue was discovered in Dolibarr through 7.0.0. There is Stored XSS in expensereport/card.php in the expense reports plugin via the comments parameter, or a public or private note...

Cross-Site Scripting (XSS)

dolibarr is vulnerable to cross-site scripting XSS. The vulnerability is possible as it does not sanitize the employee parameter in user/card.php, which would allow a remote attacker to inject arbitrary Javascript into a victim's browser...

SQL Injection

dolibarr/dolibarr is vulnerable to SQL injection. A lack of validation on the desiredstock parameter in product/card.php allows a remote authenticated attacker to execute arbitrary SQL commands via an error-based SQL injection vulnerability. This vulnerability could potentially allow for remote...

CVE-2018-19995

A stored cross-site scripting XSS vulnerability in Dolibarr 8.0.2 allows remote authenticated users to inject arbitrary web script or HTML via the "address" POST or "town" POST parameter to user/card.php...