Dolibarr 11.0.3 - Persistent Cross-Site Scripting

Title: Dolibarr 11.0.3 - Persistent Cross-Site Scripting Author: Mehmet Kelepce / Gais Cyber Security Date : 2020-04-14 Vendor: https://www.dolibarr.org/ Exploit-DB Author ID: 8763 Remotely Exploitable: Yes Dynamic Coding Language: PHP CVSSv3 Base Score: 7.4 AV:N, AC:L, PR:L, UI:N, S:C, C:L, I:L,...

XSS in Dolibarr

Dolibarr before 11.0.4 allows XSS...

GHSA-CXVR-R92M-Q9HW XSS in Dolibarr

Dolibarr before 11.0.4 allows XSS...

Dolibarr ERP/CRM DMS/ECM Module Cross-Site Scripting Vulnerability (CNVD-2020-41507)

Dolibarr ERP/CRM is a Web-based Enterprise Resource Planning ERP and Customer Relationship Management CRM system from the Dolibarr Foundation in France. The system can be used to manage products, inventory, invoices, orders, etc. DMS/ECM is one of the document management systems and enterprise...

Dolibarr ERP/CRM DMS/ECM Module Cross-Site Scripting Vulnerability

Dolibarr ERP/CRM is a Web-based Enterprise Resource Planning ERP and Customer Relationship Management CRM system from the Dolibarr Foundation in France. The system can be used to manage products, inventory, invoices, orders, etc. DMS/ECM is one of the document management systems and enterprise...

CVE-2020-13240

The DMS/ECM module in Dolibarr 11.0.4 allows users with the 'Setup documents directories' permission to rename uploaded files to have insecure file extensions. This bypasses the .noexe protection mechanism against XSS...

CVE-2020-13239

The DMS/ECM module in Dolibarr 11.0.4 renders user-uploaded .html files in the browser when the attachment parameter is removed from the direct download link. This causes XSS...

CVE-2020-13239

The DMS/ECM module in Dolibarr 11.0.4 renders user-uploaded .html files in the browser when the attachment parameter is removed from the direct download link. This causes XSS...

CVE-2020-13240

The DMS/ECM module in Dolibarr 11.0.4 allows users with the 'Setup documents directories' permission to rename uploaded files to have insecure file extensions. This bypasses the .noexe protection mechanism against XSS...

CVE-2020-13239

The DMS/ECM module in Dolibarr 11.0.4 renders user-uploaded .html files in the browser when the attachment parameter is removed from the direct download link. This causes XSS...

Design/Logic Flaw

The DMS/ECM module in Dolibarr 11.0.4 allows users with the 'Setup documents directories' permission to rename uploaded files to have insecure file extensions. This bypasses the .noexe protection mechanism against XSS...

Cross site scripting

The DMS/ECM module in Dolibarr 11.0.4 renders user-uploaded .html files in the browser when the attachment parameter is removed from the direct download link. This causes XSS...

CVE-2020-13240

The DMS/ECM module in Dolibarr 11.0.4 allows users with the 'Setup documents directories' permission to rename uploaded files to have insecure file extensions. This bypasses the .noexe protection mechanism against XSS...

UBUNTU-CVE-2020-13239

The DMS/ECM module in Dolibarr 11.0.4 renders user-uploaded .html files in the browser when the attachment parameter is removed from the direct download link. This causes XSS...

UBUNTU-CVE-2020-13240

The DMS/ECM module in Dolibarr 11.0.4 allows users with the 'Setup documents directories' permission to rename uploaded files to have insecure file extensions. This bypasses the .noexe protection mechanism against XSS...

CVE-2020-13239

Dolibarr 11.0.4 DMS/ECM module vulnerability: rendering of user-uploaded .html files in the browser when the attachment parameter is removed from the direct download link enables stored XSS. Root cause is insufficient validation/handling of HTML attachments in Dolibarr’s DMS/ECM component. Report...

CVE-2020-13239

The DMS/ECM module in Dolibarr 11.0.4 renders user-uploaded .html files in the browser when the attachment parameter is removed from the direct download link. This causes XSS...

CVE-2020-13240

Dolibarr 11.0.4's DMS/ECM module is vulnerable: users with the 'Setup documents directories' permission can rename uploaded files to have insecure file extensions, bypassing the .noexe protection mechanism against XSS. This is a stored cross‑site scripting risk described across multiple sources (...

CVE-2020-13240

The DMS/ECM module in Dolibarr 11.0.4 allows users with the 'Setup documents directories' permission to rename uploaded files to have insecure file extensions. This bypasses the .noexe protection mechanism against XSS...

Cross-Site Scripting (XSS)

dolibarr is vulnerable to cross-site scripting XSS.A remote attacker is able to inject and execute arbitrary Javascript in a user's browser via the host, slave and port parameters in htdocs/admin/ldap.php...