BIT-DOLIBARR-2020-13239

The DMS/ECM module in Dolibarr 11.0.4 renders user-uploaded .html files in the browser when the attachment parameter is removed from the direct download link. This causes XSS...

BIT-DOLIBARR-2020-11825

In Dolibarr 10.0.6, forms are protected with a CSRF token against CSRF attacks. The problem is any CSRF token in any user's session can be used in another user's session. CSRF tokens should not be valid in this situation...

BIT-DOLIBARR-2020-11823

In Dolibarr 10.0.6, if USERLOGINFAILED is active, there is a stored XSS vulnerability on the admin tools -- audit page. This may lead to stealing of the admin account...

The vulnerability of the Tittle parameter in the Product Dolibarr module of the system for planning enterprise resources and managing customer relationships allows attackers to carry out XSS attacks.

The vulnerability of the Tittle parameter in the Product Dolibarr module, a system for planning enterprise resources and managing relationships with customers, is related to the lack of measures taken to protect the website structure. Exploiting this vulnerability allows an attacker, operating...

The vulnerability of the Tittle parameter in the Events/Agenda module of the Dolibarr system, which is used for resource planning and managing relationships with customers, allows attackers to carry out XSS attacks.

The vulnerability of the Tittle parameter in the Events/Agenda module of the Dolibarr system, which is used for resource planning and managing relationships with customers, relates to the lack of measures taken to protect the website structure. Exploiting this vulnerability allows a malicious act...

CVE-2022-2060

Cross-site Scripting XSS - Stored in GitHub repository dolibarr/dolibarr prior to 16.0...

CVE-2022-0819

Code Injection in GitHub repository dolibarr/dolibarr prior to 15.0.1...

CVE-2024-23817

Dolibarr is an enterprise resource planning ERP and customer relationship management CRM software package. Version 18.0.4 has a HTML Injection vulnerability in the Home page of the Dolibarr Application. This vulnerability allows an attacker to inject arbitrary HTML tags and manipulate the rendere...

CVE-2024-5314

Vulnerabilities in Dolibarr ERP - CRM that affect version 9.0.1 and allow SQL injection. These vulnerabilities could allow a remote attacker to send a specially crafted SQL query to the system and retrieve all the information stored in the database through the parameters sortorder y sortfield in...

CVE-2024-5315

Vulnerabilities in Dolibarr ERP - CRM that affect version 9.0.1 and allow SQL injection. These vulnerabilities could allow a remote attacker to send a specially crafted SQL query to the system and retrieve all the information stored in the database through the parameters viewstatut in...

Cross-site Scripting (XSS)

Dolibarr is vulnerable to Cross-site Scripting XSS. The vulnerability is due to improper input sanitization due to a crafted payload injected into the Title parameter in the Product module, allowing attackers to execute arbitrary web scripts or HTML...

Cross-Site Scripting (XSS)

Dolibarr is vulnerable to cross-site scripting XSS. The vulnerability is due to improper input sanitization of user-supplied data in the Title parameter of the Events/Agenda module, allowing attackers to inject and execute arbitrary scripts...

GHSA-2V3R-GVQ5-QQGH Dolibarr Cross-site Scripting vulnerability

A cross-site scripting XSS vulnerability in the Events/Agenda module of Dolibarr v21.0.0-beta allows attackers to execute arbitrary web scripts or HTMl via a crafted payload injected into the Title parameter...

GHSA-X2J8-VJG7-386R Dolibarr Cross-site Scripting vulnerability

A cross-site scripting XSS vulnerability in the Product module of Dolibarr v21.0.0-beta allows attackers to execute arbitrary web scripts or HTMl via a crafted payload injected into the Title parameter...

Dolibarr Cross-site Scripting vulnerability

A cross-site scripting XSS vulnerability in the Product module of Dolibarr v21.0.0-beta allows attackers to execute arbitrary web scripts or HTMl via a crafted payload injected into the Title parameter...

Dolibarr Cross-site Scripting vulnerability

A cross-site scripting XSS vulnerability in the Events/Agenda module of Dolibarr v21.0.0-beta allows attackers to execute arbitrary web scripts or HTMl via a crafted payload injected into the Title parameter...

CVE-2024-55227

A cross-site scripting XSS vulnerability in the Events/Agenda module of Dolibarr v21.0.0-beta allows attackers to execute arbitrary web scripts or HTMl via a crafted payload injected into the Title parameter...

CVE-2024-55228

A cross-site scripting XSS vulnerability in the Product module of Dolibarr v21.0.0-beta allows attackers to execute arbitrary web scripts or HTMl via a crafted payload injected into the Title parameter...

UBUNTU-CVE-2024-55228

A cross-site scripting XSS vulnerability in the Product module of Dolibarr v21.0.0-beta allows attackers to execute arbitrary web scripts or HTMl via a crafted payload injected into the Title parameter...

UBUNTU-CVE-2024-55227

A cross-site scripting XSS vulnerability in the Events/Agenda module of Dolibarr v21.0.0-beta allows attackers to execute arbitrary web scripts or HTMl via a crafted payload injected into the Title parameter...