CVE-2022-30875

Dolibarr 12.0.5 is vulnerable to Cross Site Scripting XSS via Sql Error Page...

Dolibarr 跨站脚本漏洞

Dolibarr is an ERP/CRM system with plug-and-play modules and a well-established ecosystem with customizations and service providers worldwide. version 12.0.5 of Dolibarr suffers from a cross-site scripting vulnerability that can be exploited by attackers to cause cross-site scripting XSS attacks...

PT-2022-20362 · Dolibarr · Dolibarr

Name of the Vulnerable Software and Affected Versions: Dolibarr version 12.0.5 Description: The issue is related to Cross Site Scripting XSS via the Sql Error Page. This means that an attacker could potentially inject malicious scripts into the website, which would then be executed by the user's...

GHSA-FC6H-769X-GFF5 Dolibarr ERP and CRM contain XSS Vulnerability

Dolibarr ERP and CRM 13.0.2 allows XSS via object details, as demonstrated by and characters in the onpointermove attribute of a BODY element to the user-management feature...

Dolibarr ERP and CRM contain XSS Vulnerability

Dolibarr ERP and CRM 13.0.2 allows XSS via object details, as demonstrated by and characters in the onpointermove attribute of a BODY element to the user-management feature...

GHSA-VXR9-P2XW-M8CF Dolibarr remote PHP code execution

The website builder module in Dolibarr 13.0.2 allows remote PHP code execution because of an incomplete protection mechanism in which system, exec, and shellexec are blocked but backticks are not blocked...

Dolibarr remote PHP code execution

The website builder module in Dolibarr 13.0.2 allows remote PHP code execution because of an incomplete protection mechanism in which system, exec, and shellexec are blocked but backticks are not blocked...

Dolibarr authenticated Remote Code Execution

Dolibarr 12.0.3 is vulnerable to authenticated Remote Code Execution. An attacker who has the access the admin dashboard can manipulate the backup function by inserting a payload into the filename for the zipfilenametemplate parameter to admin/tools/dolibarrexport.php...

GHSA-7X8G-H246-GVX3 Dolibarr authenticated Remote Code Execution

Dolibarr 12.0.3 is vulnerable to authenticated Remote Code Execution. An attacker who has the access the admin dashboard can manipulate the backup function by inserting a payload into the filename for the zipfilenametemplate parameter to admin/tools/dolibarrexport.php...

GHSA-2GCP-XWXG-HQG3 Dolibarr Unrestricted Upload of File with Dangerous Type

Dolibarr before 11.0.5 allows low-privilege users to upload files of dangerous types, leading to arbitrary code execution. This occurs because .pht and .phar files can be uploaded. Also, a .htaccess file can be uploaded to reconfigure access control e.g., to let .noexe files be executed as PHP co...

Dolibarr Unrestricted Upload of File with Dangerous Type

Dolibarr before 11.0.5 allows low-privilege users to upload files of dangerous types, leading to arbitrary code execution. This occurs because .pht and .phar files can be uploaded. Also, a .htaccess file can be uploaded to reconfigure access control e.g., to let .noexe files be executed as PHP co...

Dolibarr stored Cross-Site Scripting (XSS) vulnerability

Dolibarr 11.0.4 is affected by multiple stored Cross-Site Scripting XSS vulnerabilities that could allow remote authenticated attackers to inject arbitrary web script or HTML via ticket/card.php?action=create with the subject, message, or address parameter; adherents/card.php with the societe or...

GHSA-8R2W-PHX4-MGPV Dolibarr stored Cross-Site Scripting (XSS) vulnerability

Dolibarr 11.0.4 is affected by multiple stored Cross-Site Scripting XSS vulnerabilities that could allow remote authenticated attackers to inject arbitrary web script or HTML via ticket/card.php?action=create with the subject, message, or address parameter; adherents/card.php with the societe or...

GHSA-25H3-MW3P-W8R7 Dolibarr CRM allows Privilege Escalation

Dolibarr CRM before 11.0.5 allows privilege escalation. This could allow remote authenticated attackers to upload arbitrary files via societe/document.php in which "disabled" is changed to "enabled" in the HTML source code...

Dolibarr CRM allows Privilege Escalation

Dolibarr CRM before 11.0.5 allows privilege escalation. This could allow remote authenticated attackers to upload arbitrary files via societe/document.php in which "disabled" is changed to "enabled" in the HTML source code...

GHSA-M396-2X3H-V3V4 Dolibarr reflected cross-site scripting (XSS) vulnerability

A reflected cross-site scripting XSS vulnerability in Dolibarr 11.0.4 and below allows remote attackers to inject arbitrary web script or HTML into public/notice.php related to transphrase and transkey...

Dolibarr reflected cross-site scripting (XSS) vulnerability

A reflected cross-site scripting XSS vulnerability in Dolibarr 11.0.4 and below allows remote attackers to inject arbitrary web script or HTML into public/notice.php related to transphrase and transkey...

GHSA-8V7V-6MMM-XJXM Dolibarr SQL injection vulnerability in accountancy/customer/card.php

A SQL injection vulnerability in accountancy/customer/card.php in Dolibarr 11.0.4 and below allows remote authenticated users to execute arbitrary SQL commands via the id parameter...

Dolibarr SQL injection vulnerability in accountancy/customer/card.php

A SQL injection vulnerability in accountancy/customer/card.php in Dolibarr 11.0.4 and below allows remote authenticated users to execute arbitrary SQL commands via the id parameter...

GHSA-FVF9-2HJP-W936 Dolibarr Stored Cross-site Scripting via file upload

The DMS/ECM module in Dolibarr 11.0.4 renders user-uploaded .html files in the browser when the attachment parameter is removed from the direct download link. This causes XSS...