2284 matches found
CVE-2018-19998
SQL injection vulnerability in user/card.php in Dolibarr version 8.0.2 allows remote authenticated users to execute arbitrary SQL commands via the employee parameter...
CVE-2018-19994
An error-based SQL injection vulnerability in product/card.php in Dolibarr version 8.0.2 allows remote authenticated users to execute arbitrary SQL commands via the desiredstock parameter...
CVE-2018-19992
A stored cross-site scripting XSS vulnerability in Dolibarr 8.0.2 allows remote authenticated users to inject arbitrary web script or HTML via the "address" POST or "town" POST parameter to adherents/type.php...
CVE-2018-19993
A reflected cross-site scripting XSS vulnerability in Dolibarr 8.0.2 allows remote attackers to inject arbitrary web script or HTML via the transphrase parameter to public/notice.php...
CVE-2018-19995
A stored cross-site scripting XSS vulnerability in Dolibarr 8.0.2 allows remote authenticated users to inject arbitrary web script or HTML via the "address" POST or "town" POST parameter to user/card.php...
CVE-2018-19995
CVE-2018-19995 corresponds to a stored XSS vulnerability in Dolibarr 8.0.2. The issue allows remote authenticated users to inject arbitrary web script or HTML via the address or town fields (POST) sent to user/card.php. Affected product/version: Dolibarr 8.0.2. Root cause/impact: stored XSS that ...
CVE-2018-19994
Dolibarr 8.0.2 is affected by an error-based SQL injection in product/card.php via the desiredstock parameter. The vulnerability allows remote authenticated users to execute arbitrary SQL commands, with impact on confidentiality, integrity, and availability as described in CVE-2018-19994 (NVD CVS...
CVE-2018-19992
Dolibarr 8.0.2 is affected by CVE-2018-19992: a stored XSS vulnerability allowing remote authenticated users to inject arbitrary script/HTML via the address or town POST parameters to adherents/type.php. This is confirmed across multiple connected sources (NVD OSV GNHS). The documents do not spec...
CVE-2018-19993
CVE-2018-19993 affects Dolibarr 8.0.2 and is a reflected XSS vulnerability that allows an attacker to inject arbitrary web script or HTML via the transphrase parameter to public/notice.php. The provided connected documents confirm the vulnerable component and entry details but do not specify a ve...
CVE-2018-19998
Dolibarr 8.0.2 contains a SQL injection in user/card.php via the employee parameter, allowing remote authenticated users to execute arbitrary SQL commands. This is reported across multiple feeds (NVD/OSV/CNVD), with CVSS scores up to 8.8 (HIGH) and impact on confidentiality, integrity, and availa...
PT-2019-9959 · Dolibarr · Dolibarr
Name of the Vulnerable Software and Affected Versions: Dolibarr version 8.0.2 Description: The issue is related to an error-based SQL injection, allowing remote authenticated users to execute arbitrary SQL commands. This is achieved by manipulating the desiredstock parameter in the product/card.p...
PT-2019-9957 · Dolibarr · Dolibarr
Name of the Vulnerable Software and Affected Versions: Dolibarr version 8.0.2 Description: A stored cross-site scripting issue allows remote authenticated users to inject arbitrary web script or HTML via the address or town parameter to "adherents/type.php" API endpoint. Recommendations: For...
PT-2019-9961 · Dolibarr · Dolibarr
Name of the Vulnerable Software and Affected Versions: Dolibarr version 8.0.2 Description: A SQL injection issue allows remote authenticated users to execute arbitrary SQL commands via the employee parameter in the user/card.php file. Recommendations: For Dolibarr version 8.0.2, consider...
PT-2019-9958 · Dolibarr · Dolibarr
Name of the Vulnerable Software and Affected Versions: Dolibarr version 8.0.2 Description: A reflected cross-site scripting issue allows remote attackers to inject arbitrary web script or HTML via the transphrase parameter to the "public/notice.php" endpoint. Recommendations: For Dolibarr version...
Dolibarr < 8.0.4 XSS Vulnerability
Dolibarr is prone to a cross-site scripting XSS vulnerability. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:dolibarr:dolibarr"...
Cross-Site Scripting (XSS)
dolibarr/dolibarr is vulnerable to cross-site scripting XSS. The datatoexport parameter in /exports/export.php is not properly sanitized, which would allow a remote attacker to inject arbitrary Javascript into a victim's browser to steal session tokens or perform unwanted actions on behalf of the...
CVE-2018-19799
Dolibarr ERP/CRM through 8.0.3 has /exports/export.php?datatoexport= XSS...
CVE-2018-19799
Dolibarr ERP/CRM through 8.0.3 has /exports/export.php?datatoexport= XSS...
