dolibarr HTML Injection

Title: HTML Injection in dolibarr Author: Sergio Galán - @NaxoneZ Date: Dec 24,2015 Vendor Homepage: http://www.dolibarr.es/ Vulnerable version: More Info =======https://github.com/Dolibarr/dolibarr/issues/4291 Fixed =======...

Dolibarr 3.8.3 Cross Site Scripting

Exploit Title: XSS on dolibarr 3.8.3 Date: 03/01/2016 Author: Mickael Dorigny @ Synetis Vendor or Software Link: http://www.dolibarr.org/ Category: XSS Dolibarr description : ====================================================================== Dolibarr ERP & CRM is a modern and easy to use web...

CVE-2015-3935

Multiple cross-site scripting XSS vulnerabilities in Dolibarr ERP/CRM 3.5 and 3.6 allow remote attackers to inject arbitrary web script or HTML via the Business Search searchnom field to 1 htdocs/societe/societe.php or 2 htdocs/societe/admin/societe.php...

CVE-2015-3935

Multiple cross-site scripting XSS vulnerabilities in Dolibarr ERP/CRM 3.5 and 3.6 allow remote attackers to inject arbitrary web script or HTML via the Business Search searchnom field to 1 htdocs/societe/societe.php or 2 htdocs/societe/admin/societe.php...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in Dolibarr ERP/CRM 3.5 and 3.6 allow remote attackers to inject arbitrary web script or HTML via the Business Search searchnom field to 1 htdocs/societe/societe.php or 2 htdocs/societe/admin/societe.php...

UBUNTU-CVE-2015-3935

Multiple cross-site scripting XSS vulnerabilities in Dolibarr ERP/CRM 3.5 and 3.6 allow remote attackers to inject arbitrary web script or HTML via the Business Search searchnom field to 1 htdocs/societe/societe.php or 2 htdocs/societe/admin/societe.php...

CVE-2015-3935

Multiple cross-site scripting XSS vulnerabilities in Dolibarr ERP/CRM 3.5 and 3.6 allow remote attackers to inject arbitrary web script or HTML via the Business Search searchnom field to 1 htdocs/societe/societe.php or 2 htdocs/societe/admin/societe.php...

CVE-2015-3935

CVE-2015-3935 affects Dolibarr ERP/CRM versions 3.5 and 3.6. The vulnerability is a cross-site scripting (XSS) flaw exposed via the Business Search (search_nom) field, reachable on htdocs/societe/societe.php and htdocs/societe/admin/societe.php. The underlying issue is that user-supplied input is...

Multiple HTML Injection Vulnerabilities in Dolibarr

Dolibarr is a WEB-based open source ERP and CRM system . Dolibarr suffers from multiple HTML injection vulnerabilities due to the program failing to adequately filter user-submitted input. The vulnerabilities could be exploited to allow an attacker to execute arbitrary script code in the context ...

Dolibarr 3.5 / 3.6 HTML Injection

Title: HTML Injection in dolibarr Author: Sergio Galán - @NaxoneZ Date: May 20,2015 Vendor Homepage: http://www.dolibarr.es/ Vulnerable version: 3.5 / 3.6 CVE: CVE-2015-3935 Dolibarr no properly escape untrusted data to prevent injection Page affected - dolibarr-3.7.0/htdocs/societe/societe.php -...

CVE-2014-7137 - Multiple SQL Injections in Dolibarr ERP & CRM

Vulnerability title: Multiple SQL Injections in Dolibarr ERP & CRM CVE: CVE-2014-7137 Vendor: Dolibarr ERP & CRM Product: Dolibarr ERP & CRM Affected version: 3.5.3 Fixed version: 3.6.1 Reported by: Jerzy Kramarz Details: SQL injection has been found and confirmed within the software as an...

CVE-2014-7137

Multiple SQL injection vulnerabilities in Dolibarr ERP/CRM before 3.6.1 allow remote authenticated users to execute arbitrary SQL commands via the 1 contactid parameter in an addcontact action, 2 ligne parameter in a swapstatut action, or 3 projectref parameter to projet/tasks/contact.php; 4 line...

CVE-2014-7137

Multiple SQL injection vulnerabilities in Dolibarr ERP/CRM before 3.6.1 allow remote authenticated users to execute arbitrary SQL commands via the 1 contactid parameter in an addcontact action, 2 ligne parameter in a swapstatut action, or 3 projectref parameter to projet/tasks/contact.php; 4 line...

Sql injection

Multiple SQL injection vulnerabilities in Dolibarr ERP/CRM before 3.6.1 allow remote authenticated users to execute arbitrary SQL commands via the 1 contactid parameter in an addcontact action, 2 ligne parameter in a swapstatut action, or 3 projectref parameter to projet/tasks/contact.php; 4 line...

CVE-2014-7137

CVE-2014-7137 covers multiple SQL injection vulnerabilities in Dolibarr ERP/CRM before 3.6.1. An authenticated user could exploit numerous parameters across modules (e.g., product/stock/fiche.php; projet/tasks/contact.php; compta/prelevement/liste.php; holiday/index.php; etc.) to execute arbitrar...

CVE-2014-7137

Multiple SQL injection vulnerabilities in Dolibarr ERP/CRM before 3.6.1 allow remote authenticated users to execute arbitrary SQL commands via the 1 contactid parameter in an addcontact action, 2 ligne parameter in a swapstatut action, or 3 projectref parameter to projet/tasks/contact.php; 4 line...

Dolibarr ERP And CRM 3.5.3 SQL Injection Vulnerability

Dolibarr ERP and CRM version 3.5.3 suffers from multiple remote SQL injection vulnerabilities. Vulnerability title: Multiple SQL Injections in Dolibarr ERP & CRM CVE: CVE-2014-7137 Vendor: Dolibarr ERP & CRM Product: Dolibarr ERP & CRM Affected version: 3.5.3 Fixed version: 3.6.1 Reported by: Jer...

Dolibarr ERP And CRM 3.5.3 SQL Injection

Vulnerability title: Multiple SQL Injections in Dolibarr ERP & CRM CVE: CVE-2014-7137 Vendor: Dolibarr ERP & CRM Product: Dolibarr ERP & CRM Affected version: 3.5.3 Fixed version: 3.6.1 Reported by: Jerzy Kramarz Details: SQL injection has been found and confirmed within the software as an...

CVE-2014-3991

Multiple cross-site scripting XSS vulnerabilities in Dolibarr ERP/CRM 3.5.3 allow remote attackers to inject arbitrary web script or HTML via the 1 dolusejmobile, 2 doloptimizesmallscreen, 3 dolnomousehover, 4 dolhidetopmenu, 5 dolhideleftmenu, 6 mainmenu, or 7 leftmenu parameter to index.php; th...

CVE-2014-3992

Multiple SQL injection vulnerabilities in Dolibarr ERP/CRM 3.5.3 allow remote authenticated users to execute arbitrary SQL commands via the 1 entity parameter in an update action to user/fiche.php or 2 sortorder parameter to user/group/index.php...