2284 matches found
Cross-site Scripting (XSS) - Generic in dolibarr/dolibarr
Description dolibarr is a modern and easy to use web software to manage your business. The error page is vulnerable to self XSS because of lack of escaping on $SERVER'HTTPUSERAGENT' variable before printing it. The flaw is in the dolprinterror function in the htdocs/core/lib/functions.lib.php fil...
Cross-site Scripting (XSS) - Generic in dolibarr/dolibarr
Overview dolibarr is a modern and easy to use web software to manage your business. This package is vulnerable to Cross-site Scripting XSS. The module renders user-uploaded html files in the browser when the attachment parameter is removed from the direct download URL...
Cross-site Scripting (XSS)
dolibarr is vulnerable to cross-site scripting XSS. It is possible because it does not escape the user-provided transkey value, allowing an attacker can inject malicious script and get executed the script when the page is visited...
The vulnerability of the core/get_menudiv.php component of the Dolibarr resource planning and customer relationship management system allows a hacker to gain unauthorized access to protected information.
The vulnerability of the core/getmenudiv.php component of the Dolibarr resource planning and customer relationship management system is related to the lack of checks on the correctness of the provided data. Exploiting this vulnerability can allow an attacker, operating remotely, to gain...
Dolibarr ERP/CRM Cross-Site Scripting Vulnerability (CNVD-2020-52837)
Dolibarr ERP/CRM is a Web-based enterprise resource planning ERP and customer relationship management CRM system from the Dolibarr Foundation in France. The system can be used to manage products, inventory, invoices, orders, and more. A cross-site scripting vulnerability exists in Dolibarr ERP/CR...
CVE-2020-14475
A reflected cross-site scripting XSS vulnerability in Dolibarr 11.0.3 allows remote attackers to inject arbitrary web script or HTML into public/notice.php related to transphrase and transkey...
CVE-2020-14475
A reflected cross-site scripting XSS vulnerability in Dolibarr 11.0.3 allows remote attackers to inject arbitrary web script or HTML into public/notice.php related to transphrase and transkey...
Cross site scripting
A reflected cross-site scripting XSS vulnerability in Dolibarr 11.0.3 allows remote attackers to inject arbitrary web script or HTML into public/notice.php related to transphrase and transkey...
CVE-2020-14475
A reflected cross-site scripting XSS vulnerability in Dolibarr 11.0.3 allows remote attackers to inject arbitrary web script or HTML into public/notice.php related to transphrase and transkey...
CVE-2020-14475
A reflected cross-site scripting XSS vulnerability in Dolibarr 11.0.3 allows remote attackers to inject arbitrary web script or HTML into public/notice.php related to transphrase and transkey...
CVE-2020-14475
Dolibarr ERP/CRM (Dolibarr) is affected by a reflected XSS vulnerability in public/notice.php related to transphrase/transkey. The CVE-2020-14475 entry notes Dolibarr 11.0.3 as vulnerable, with several connected advisories extending to 11.0.4 and below. The underlying issue is input not properly ...
SQL Injection
dolibarr/dolibarr is vulnerable to SQL injection. The vulnerability exists as the id parameter type was not enforced to the int type, and could be used to inject and execute arbitrary SQL statements...
Dolibarr SQL Injection Vulnerability (CNVD-2021-24259)
Dolibarr ERP/CRM is an open source software/freeware for small and medium-sized businesses, organizations or freelancers. It includes different features such as Enterprise Resource Planning ERP and Customer Relationship Management CRM, as well as applications for other different activities. A SQL...
CVE-2020-14443
A SQL injection vulnerability in accountancy/customer/card.php in Dolibarr 11.0.3 allows remote authenticated users to execute arbitrary SQL commands via the id parameter...
CVE-2020-14443
A SQL injection vulnerability in accountancy/customer/card.php in Dolibarr 11.0.3 allows remote authenticated users to execute arbitrary SQL commands via the id parameter...
Sql injection
A SQL injection vulnerability in accountancy/customer/card.php in Dolibarr 11.0.3 allows remote authenticated users to execute arbitrary SQL commands via the id parameter...
UBUNTU-CVE-2020-14443
A SQL injection vulnerability in accountancy/customer/card.php in Dolibarr 11.0.3 allows remote authenticated users to execute arbitrary SQL commands via the id parameter...
CVE-2020-14443
A SQL injection vulnerability in accountancy/customer/card.php in Dolibarr 11.0.3 allows remote authenticated users to execute arbitrary SQL commands via the id parameter...
CVE-2020-14443
CVE-2020-14443 describes a SQL injection in Dolibarr 11.0.3. The vulnerability is in accountancy/customer/card.php, where an authenticated remote user can manipulate the id parameter to execute arbitrary SQL commands. The core issue is improper input handling in that PHP script, enabling injectio...