Dolibarr < 24.0.0 - Authorization Bypass via hashp Parameter

Dolibarr ERP/CRM versions 23.0.4 through 24.0.0 contain an authorization bypass vulnerability in document.php and viewimage.php. The public share-link feature forces NOLOGIN when hashp is present, but the value 'shared' skips token resolution while the override still fires for any non-empty hashp...

CVE-2026-89013

CVE-2026-89013 — Omisión de autorización en Dolibarr con hashp=shared Exploit para CVE-2026-89013: document.php y viewimage.php fuerzan NOLOGIN cuando el parámetro hashp está presente. El valor de marcador interno shared omite la resolución del token de compartición, pero la anulación del control...

GHSA-F6H3-66XR-HQR2 Dolibarr ERP and CRM contain XSS Vulnerability

Dolibarr CRM/ERP 10.0.3 allows viewimage.php?file= Stored XSS due to JavaScript execution in an SVG image for a profile picture...

Cross-site Scripting (XSS)

dolibarr/dolibarr is vulnerable to cross-site scripting XSS. The vulnerability exists as it is possible to upload a SVG with a XSS payload and cause the script to be executed when rendered in viewimage.php...

CVE-2019-19206

Dolibarr CRM/ERP 10.0.3 allows viewimage.php?file= Stored XSS due to JavaScript execution in an SVG image for a profile picture...

CVE-2019-19206: Improper Neutralization of Input During Web Page Generation

Dolibarr CRM/ERP 10.0.3 allows viewimage.php?file= Stored XSS due to JavaScript execution in an SVG image for a profile picture...

UBUNTU-CVE-2013-2093

Dolibarr ERP/CRM 3.3.1 does not properly validate user input in viewimage.php and barcode.lib.php which allows remote attackers to execute arbitrary commands...

Design/Logic Flaw

Dolibarr ERP/CRM 3.3.1 does not properly validate user input in viewimage.php and barcode.lib.php which allows remote attackers to execute arbitrary commands...

CVE-2013-2093

Dolibarr ERP/CRM 3.3.1 does not properly validate user input in viewimage.php and barcode.lib.php which allows remote attackers to execute arbitrary commands...

CVE-2013-2093

Dolibarr ERP/CRM 3.3.1 is affected by CVE-2013-2093 due to improper validation of user input in viewimage.php and barcode.lib.php, enabling remote attackers to execute arbitrary commands. The cited vulnerability is rated as high/critical under the CVSS metrics (CVSSv3.1: AV:N/AC:L/PR:N/UI:N/S:U/C...

PT-2019-6875 · Dolibarr · Dolibarr Erp/Crm

Name of the Vulnerable Software and Affected Versions: Dolibarr ERP/CRM version 3.3.1 Description: The issue arises from improper validation of user input in certain files, allowing remote attackers to execute arbitrary commands. This is specifically related to the viewimage.php and barcode.lib.p...

CVE-2013-2093: Improper Input Validation

Dolibarr ERP/CRM 3.3.1 does not properly validate user input in viewimage.php and barcode.lib.php which allows remote attackers to execute arbitrary commands...

CVE-2019-11199

Dolibarr ERP/CRM 9.0.1 was affected by stored XSS within uploaded files. These vulnerabilities allowed the execution of a JavaScript payload each time any regular user or administrative user clicked on the malicious link hosted on the same domain. The vulnerabilities could be exploited by low...

UBUNTU-CVE-2019-11199

Dolibarr ERP/CRM 9.0.1 was affected by stored XSS within uploaded files. These vulnerabilities allowed the execution of a JavaScript payload each time any regular user or administrative user clicked on the malicious link hosted on the same domain. The vulnerabilities could be exploited by low...

CVE-2019-11199: Improper Neutralization of Input During Web Page Generation

Dolibarr ERP/CRM 9.0.1 was affected by stored XSS within uploaded files. These vulnerabilities allowed the execution of a JavaScript payload each time any regular user or administrative user clicked on the malicious link hosted on the same domain. The vulnerabilities could be exploited by low...

palodurocanyon.com XSS vulnerability

Open Bug Bounty ID: OBB-646901 Description| Value ---|--- Affected Website:| palodurocanyon.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

trinketsandtrash.org XSS vulnerability

Open Bug Bounty ID: OBB-622913 Description| Value ---|--- Affected Website:| trinketsandtrash.org Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

CVE-2014-3991

Multiple cross-site scripting XSS vulnerabilities in Dolibarr ERP/CRM 3.5.3 allow remote attackers to inject arbitrary web script or HTML via the 1 dolusejmobile, 2 doloptimizesmallscreen, 3 dolnomousehover, 4 dolhidetopmenu, 5 dolhideleftmenu, 6 mainmenu, or 7 leftmenu parameter to index.php; th...

CVE-2014-3991

Multiple cross-site scripting XSS vulnerabilities in Dolibarr ERP/CRM 3.5.3 allow remote attackers to inject arbitrary web script or HTML via the 1 dolusejmobile, 2 doloptimizesmallscreen, 3 dolnomousehover, 4 dolhidetopmenu, 5 dolhideleftmenu, 6 mainmenu, or 7 leftmenu parameter to index.php; th...

CVE-2014-3991: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in Dolibarr ERP/CRM 3.5.3 allow remote attackers to inject arbitrary web script or HTML via the 1 dolusejmobile, 2 doloptimizesmallscreen, 3 dolnomousehover, 4 dolhidetopmenu, 5 dolhideleftmenu, 6 mainmenu, or 7 leftmenu parameter to index.php; th...