GHSA-FVF9-2HJP-W936 Dolibarr Stored Cross-site Scripting via file upload

The DMS/ECM module in Dolibarr 11.0.4 renders user-uploaded .html files in the browser when the attachment parameter is removed from the direct download link. This causes XSS...

GHSA-F848-R5G6-6GPF Dolibarr Stored Cross-site Scripting

The DMS/ECM module in Dolibarr 11.0.4 allows users with the 'Setup documents directories' permission to rename uploaded files to have insecure file extensions. This bypasses the .noexe protection mechanism against XSS...

Dolibarr Stored Cross-site Scripting

The DMS/ECM module in Dolibarr 11.0.4 allows users with the 'Setup documents directories' permission to rename uploaded files to have insecure file extensions. This bypasses the .noexe protection mechanism against XSS...

Incorrect Authorization in Dolibarr

core/getmenudiv.php in Dolibarr before 11.0.4 allows remote authenticated attackers to bypass intended access restrictions via a non-alphanumeric menu parameter...

GHSA-RG8M-84JF-9367 Incorrect Authorization in Dolibarr

core/getmenudiv.php in Dolibarr before 11.0.4 allows remote authenticated attackers to bypass intended access restrictions via a non-alphanumeric menu parameter...

Dolibarr Cross-Site Request Forgery Vulnerability

In Dolibarr 10.0.6, forms are protected with a Cross-Site Request Forgery CSRF token against CSRF attacks. The problem is any CSRF token in any user's session can be used in another user's session. CSRF tokens should not be valid in this situation...

Dolibarr stored Cross-site Scripting vulnerability

In Dolibarr 10.0.6, if USERLOGINFAILED is active, there is a stored XSS vulnerability on the admin tools -- audit page. This may lead to stealing of the admin account...

GHSA-M66X-WM27-XXPC Dolibarr Cross-Site Request Forgery Vulnerability

In Dolibarr 10.0.6, forms are protected with a Cross-Site Request Forgery CSRF token against CSRF attacks. The problem is any CSRF token in any user's session can be used in another user's session. CSRF tokens should not be valid in this situation...

GHSA-Q938-82FW-WFCF Dolibarr stored Cross-site Scripting vulnerability

In Dolibarr 10.0.6, if USERLOGINFAILED is active, there is a stored XSS vulnerability on the admin tools -- audit page. This may lead to stealing of the admin account...

Dolibarr ERP and CRM contain XSS Vulnerability

Dolibarr ERP/CRM before 10.0.3 allows XSS because uploaded HTML documents are served as text/html despite being renamed to .noexe files...

GHSA-JH3J-XFV2-F9M9 Dolibarr ERP and CRM SQLi

Dolibarr ERP/CRM before 10.0.3 allows SQL Injection...

GHSA-GFHF-2XR5-2FVW Dolibarr ERP and CRM contain XSS Vulnerability

Dolibarr ERP/CRM before 10.0.3 has an Insufficient Filtering issue that can lead to user/card.php XSS...

Dolibarr ERP and CRM SQLi

Dolibarr ERP/CRM before 10.0.3 allows SQL Injection...

Dolibarr ERP and CRM contain XSS Vulnerability

Dolibarr ERP/CRM before 10.0.3 has an Insufficient Filtering issue that can lead to user/card.php XSS...

GHSA-87R3-4GC8-F897 Dolibarr ERP and CRM contain XSS Vulnerability

Dolibarr ERP/CRM before 10.0.3 allows XSS because uploaded HTML documents are served as text/html despite being renamed to .noexe files...

GHSA-PM57-926C-28MR Dolibarr Cross-site Scripting via the qty parameter in product/fournisseurs.php

Dolibarr ERP/CRM 3.0 through 10.0.3 allows XSS via the qty parameter to product/fournisseurs.php product price screen...

Dolibarr Cross-site Scripting via the qty parameter in product/fournisseurs.php

Dolibarr ERP/CRM 3.0 through 10.0.3 allows XSS via the qty parameter to product/fournisseurs.php product price screen...

GHSA-JH69-6VV2-WFP5 Dolibarr ERP and CRM contain XSS Vulnerability

Dolibarr 11.0 allows XSS via the joinfiles, topic, or code parameter, or the HTTP Referer header...

Dolibarr ERP and CRM contain XSS Vulnerability

Dolibarr 11.0 allows XSS via the joinfiles, topic, or code parameter, or the HTTP Referer header...

Dolibarr Improper Restriction of Excessive Authentication Attempts

The htdocs/index.php?mainmenu=home login page in Dolibarr 10.0.6 allows an unlimited rate of failed authentication attempts...