Cross site scripting

Dolibarr ERP/CRM 9.0.1 was affected by stored XSS within uploaded files. These vulnerabilities allowed the execution of a JavaScript payload each time any regular user or administrative user clicked on the malicious link hosted on the same domain. The vulnerabilities could be exploited by low...

CVE-2019-11199

Dolibarr ERP/CRM 9.0.1 is affected by a stored XSS in uploaded files (viewimage.php) that can execute JavaScript when an arbitrary link on the Dolibarr domain is clicked. The issue stems from lack of contextual output encoding in the uploaded content, enabling exploitation by low-privilege users ...

PT-2019-12177

Name of the Vulnerable Software and Affected Versions Dolibarr ERP/CRM version 9.0.1 Description The issue concerns stored XSS within uploaded files, allowing the execution of a JavaScript payload when a user clicks on a malicious link hosted on the same domain. This could be exploited by...