CVE-2020-13240

Dolibarr 11.0.4's DMS/ECM module is vulnerable: users with the 'Setup documents directories' permission can rename uploaded files to have insecure file extensions, bypassing the .noexe protection mechanism against XSS. This is a stored cross‑site scripting risk described across multiple sources (...