2284 matches found
UBUNTU-CVE-2018-10092
The admin panel in Dolibarr before 7.0.2 might allow remote attackers to execute arbitrary commands by leveraging support for updating the antivirus command and parameters used to scan file uploads...
UBUNTU-CVE-2018-10094
SQL injection vulnerability in Dolibarr before 7.0.2 allows remote attackers to execute arbitrary SQL commands via vectors involving integer parameters without quotes...
UBUNTU-CVE-2018-10095
Cross-site scripting XSS vulnerability in Dolibarr before 7.0.2 allows remote attackers to inject arbitrary web script or HTML via the foruserlogin parameter to adherents/cartes/carte.php...
UBUNTU-CVE-2018-9019
SQL Injection vulnerability in Dolibarr before version 7.0.2 allows remote attackers to execute arbitrary SQL commands via the sortfield parameter to /accountancy/admin/accountmodel.php, /accountancy/admin/categorieslist.php, /accountancy/admin/journalslist.php, /admin/dict.php,...
CVE-2018-10092
Dolibarr
CVE-2018-10094
SQL injection vulnerability in Dolibarr before 7.0.2 allows remote attackers to execute arbitrary SQL commands via vectors involving integer parameters without quotes...
CVE-2018-10095
Cross-site scripting XSS vulnerability in Dolibarr before 7.0.2 allows remote attackers to inject arbitrary web script or HTML via the foruserlogin parameter to adherents/cartes/carte.php...
CVE-2018-10092
The admin panel in Dolibarr before 7.0.2 might allow remote attackers to execute arbitrary commands by leveraging support for updating the antivirus command and parameters used to scan file uploads...
CVE-2018-9019
SQL Injection vulnerability in Dolibarr before version 7.0.2 allows remote attackers to execute arbitrary SQL commands via the sortfield parameter to /accountancy/admin/accountmodel.php, /accountancy/admin/categorieslist.php, /accountancy/admin/journalslist.php, /admin/dict.php,...
CVE-2018-10094
CVE-2018-10094 affects Dolibarr ERP/CRM prior to version 7.0.2. The vulnerability is a SQL injection that lets remote attackers execute arbitrary SQL commands via integer parameters without quotes, with evidence of exploitation and public PoCs. Exploits are documented (Exploit-DB 44805) and a Met...
CVE-2018-9019
Dolibarr before 7.0.2 is vulnerable to SQL Injection via the sortfield parameter in multiple admin scripts (e.g., accountmodel.php, categories_list.php, journals_list.php, dict.php, mails_templates.php, website.php). The underlying issue is unsafely concatenated SQL in these endpoints, enabling r...
CVE-2018-10095
Dolibarr before 7.0.2 is affected by CVE-2018-10095: an XSS vulnerability in the foruserlogin parameter to adherents/cartes/carte.php, allowing remote attackers to inject arbitrary script/HTML in the victim’s browser. The issue is caused by improper input handling in this endpoint. Impact stateme...
SQL Injection
dolibarr/dolibarr is vulnerable to SQL injection attack. The attack is possible because it does not use prepared SQL queries in order to avoid injection of arbitrary code via user input SQL commands...
Remote Code Execution (RCE)
dolibarr/dolibarr is susceptible to remote code execution RCE. The vulnerability can be triggered because it grants authentication and replaces an antivirus command with a malicious payload once the administrator is tricked to click a malicious link...
Cross-Site Scripting (XSS)
Dolibarr is vulnerable to cross-site scriptingXSS attacks. The attacks can be triggered because an authenticated user can pass arbitrary script via unsanitized parameter...
SQL Injection
Dolibarr is vulnerable to SQL injection attacks. The attacks exist because it does not properly sanitize the viewstatut and propalstatut aka searchstatut parameters in comm/propal/list.php, allowing the authenticated user to inject arbitrary SQL code through it...
Sql injection
Dolibarr ERP/CRM is affected by multiple SQL injection vulnerabilities in versions through 7.0.0 via comm/propal/list.php viewstatut parameter or comm/propal/list.php propalstatut parameter, aka searchstatut parameter...
CVE-2017-18260
Dolibarr ERP/CRM is affected by multiple SQL injection vulnerabilities in versions through 7.0.0 via comm/propal/list.php viewstatut parameter or comm/propal/list.php propalstatut parameter, aka searchstatut parameter...
CVE-2017-18260
Dolibarr ERP/CRM is affected by multiple SQL injection vulnerabilities in versions through 7.0.0 via comm/propal/list.php viewstatut parameter or comm/propal/list.php propalstatut parameter, aka searchstatut parameter...