github.com/Dolibarr/dolibarr is vulnerable to cross-site scripting (XSS). A remote attacker is able to store and inject arbitrary Javascript into a victimm’s browser via the comments and public or private notes, which executes in the context of the user’s browser when the comments or notes are loaded.