Skip to content
OpenAdvisories

Package · Ubuntu

dolibarr

134 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

58 results · Clear filters · Feed

  • Medium 5.4
    CVE-2019-16686

    Dolibarr Cross-site Scripting in a User Note section

    Dolibarr 9.0.5 has stored XSS in a User Note section to note.php. A user with no privileges can inject script to attack the admin.

    dolibarr dolibarr/dolibarr Ubuntu Packagist
  • Medium 5.4
    CVE-2019-16685

    Dolibarr stored Cross-site Scripting vulnerability

    Dolibarr 9.0.5 has stored XSS vulnerability via a User Group Description section to card.php. A user with the "Create/modify other users, groups and permissions" privilege can inject script and can also achieve privilege escalation.

    dolibarr dolibarr/dolibarr Ubuntu Packagist
  • Medium 6.1
    CVE-2019-16197 Public exploit

    Cross-site scripting in Dolibarr

    In htdocs/societe/card.php in Dolibarr 10.0.1, the value of the User-Agent HTTP header is copied into the HTML document as plain text between tags, leading to XSS.

    dolibarr dolibarr/dolibarr Ubuntu Packagist
  • Medium 6.1
    CVE-2019-1010016

    Dolibarr Cross Site Scripting (XSS)

    Dolibarr 6.0.4 is affected by: Cross Site Scripting (XSS). The impact is: Cookie stealing. The component is: htdocs/product/stats/card.php. The attack vector is: Victim must click a specially crafted link sent by the attacker.

    Dolibarr ERP & CRM Dolibarr dolibarr dolibarr/dolibarr Ubuntu Packagist
  • Medium 6.1
    CVE-2018-16808

    Dolibarr Stored Cross-site Scripting in expensereport/card.php

    An issue was discovered in Dolibarr through 7.0.0. There is Stored XSS in expensereport/card.php in the expense reports plugin via the comments parameter, or a public or private note.

    dolibarr dolibarr/dolibarr Ubuntu Packagist
  • Medium 6.1
    CVE-2018-19993

    Dolibarr reflected cross-site scripting (XSS) vulnerability

    A reflected cross-site scripting (XSS) vulnerability in Dolibarr 8.0.2 allows remote attackers to inject arbitrary web script or HTML via the transphrase parameter to public/notice.php.

    dolibarr dolibarr/dolibarr Ubuntu Packagist
  • Medium 5.4
    CVE-2018-19995

    Dolibarr stored cross-site scripting (XSS) vulnerability

    A stored cross-site scripting (XSS) vulnerability in Dolibarr 8.0.2 allows remote authenticated users to inject arbitrary web script or HTML via the "address" (POST) or "town" (POST) parameter to user/card.php.

    dolibarr dolibarr/dolibarr Ubuntu Packagist
  • Medium 5.4
    CVE-2018-19992

    Dolibarr stored cross-site scripting (XSS) vulnerability

    A stored cross-site scripting (XSS) vulnerability in Dolibarr 8.0.2 allows remote authenticated users to inject arbitrary web script or HTML via the "address" (POST) or "town" (POST) parameter to adherents/type.php.

    dolibarr dolibarr/dolibarr Ubuntu Packagist
  • Medium 6.1
    CVE-2018-19799 Public exploit

    Dolibarr ERP and CRM contain XSS Vulnerability

    Dolibarr ERP/CRM through 8.0.3 has /exports/export.php?datatoexport= XSS.

    dolibarr dolibarr/dolibarr Ubuntu Packagist
  • Medium 6.1
    CVE-2018-10095 Scanner template EPSS 87%

    Dolibarr Cross-site scripting (XSS) vulnerability

    Cross-site scripting (XSS) vulnerability in Dolibarr before 7.0.2 allows remote attackers to inject arbitrary web script or HTML via the foruserlogin parameter to adherents/cartes/carte.php.

    dolibarr dolibarr/dolibarr Ubuntu Packagist
  • Medium 5.4
    CVE-2017-18259

    Dolibarr ERP and CRM contain XSS Vulnerability

    Dolibarr ERP/CRM is affected by stored Cross-Site Scripting (XSS) in versions through 7.0.0.

    dolibarr dolibarr/dolibarr Ubuntu Packagist
  • Medium 5.4
    CVE-2017-9838

    Dolibarr Cross-Site Scripting (XSS) vulnerability

    Dolibarr ERP/CRM is affected by multiple reflected Cross-Site Scripting (XSS) vulnerabilities in versions before 5.0.4: index.php (leftmenu parameter), core/ajax/box.php (PATH_INFO), product/stats/card.php (type parameter), holiday/list.php (month_create, mon…

    dolibarr dolibarr/dolibarr Ubuntu Packagist
  • Medium 5.4
    CVE-2017-1000509

    Dolibarr ERP and CRM contain XSS Vulnerability

    Dolibarr version 6.0.2 contains a Cross Site Scripting (XSS) vulnerability in Product details that can result in execution of javascript code.

    dolibarr dolibarr/dolibarr Ubuntu Packagist
  • Medium 6.1
    CVE-2017-17971

    Dolibarr ERP and CRM contain XSS Vulnerability

    The test_sql_and_script_inject function in htdocs/main.inc.php in Dolibarr ERP/CRM 6.0.4 blocks some event attributes but neither onclick nor onscroll, which allows XSS.

    dolibarr dolibarr/dolibarr Ubuntu Packagist
  • Medium 5.4
    CVE-2017-14239

    Dolibarr cross-site scripting (XSS) vulnerability

    Multiple cross-site scripting (XSS) vulnerabilities in Dolibarr ERP/CRM 6.0.0 allow remote authenticated users to inject arbitrary web script or HTML via the (1) CompanyName, (2) CompanyAddress, (3) CompanyZip, (4) CompanyTown, (5) Fax, (6) EMail, (7) Web, (8…

    dolibarr dolibarr/dolibarr Ubuntu Packagist
  • Medium 5.4
    CVE-2017-14241

    Dolibarr ERP and CRM contain XSS Vulnerability

    Cross-site scripting (XSS) vulnerability in Dolibarr ERP/CRM 6.0.0 allows remote authenticated users to inject arbitrary web script or HTML via the Title parameter to htdocs/admin/menus/edit.php.

    dolibarr dolibarr/dolibarr Ubuntu Packagist
  • Medium 6.1
    CVE-2017-7887

    Dolibarr ERP and CRM contain XSS Vulnerability

    Dolibarr ERP/CRM 4.0.4 has XSS in doli/societe/list.php via the sall parameter.

    dolibarr dolibarr/dolibarr Ubuntu Packagist
  • Medium 6.8
    CVE-2017-8879

    Dolibarr allows password changes without supplying the current password

    Dolibarr ERP/CRM 4.0.4 allows password changes without supplying the current password, which makes it easier for physically proximate attackers to obtain access via an unattended workstation.

    dolibarr dolibarr/dolibarr Ubuntu Packagist