Dolibarr Erp Crm vulnerabilities

CVE-2024-55228 [CRITICAL] CWE-79 CVE-2024-55228: A cross-site scripting (XSS) vulnerability in the Product module of Dolibarr v21.0.0-beta allows att A cross-site scripting (XSS) vulnerability in the Product module of Dolibarr v21.0.0-beta allows attackers to execute arbitrary web scripts or HTMl via a crafted payload injected into the Title parameter.

CVE-2023-4198 [MEDIUM] CWE-862 CVE-2023-4198: Improper Access Control in Dolibarr ERP CRM <= v17.0.3 allows an unauthorized authenticated user to Improper Access Control in Dolibarr ERP CRM <= v17.0.3 allows an unauthorized authenticated user to read a database table containing customer data

CVE-2019-15062 [HIGH] CWE-352 CVE-2019-15062: An issue was discovered in Dolibarr 11.0.0-alpha. A user can store an IFRAME element (containing a u An issue was discovered in Dolibarr 11.0.0-alpha. A user can store an IFRAME element (containing a user/card.php CSRF request) in his Linked Files settings page. When visited by the admin, this could completely take over the admin account. (The protection mechanism for CSRF is to check the Referer header; however, because the attack is from one of the

CVE-2024-31503 [HIGH] CWE-352 CVE-2024-31503: Incorrect access control in Dolibarr ERP CRM versions 19.0.0 and before, allows authenticated attack Incorrect access control in Dolibarr ERP CRM versions 19.0.0 and before, allows authenticated attackers to steal victim users' session cookies and CSRF protection tokens via user interaction with a crafted web page, leading to account takeover.

CVE-2020-11825 [HIGH] CWE-352 CVE-2020-11825: In Dolibarr 10.0.6, forms are protected with a CSRF token against CSRF attacks. The problem is any C In Dolibarr 10.0.6, forms are protected with a CSRF token against CSRF attacks. The problem is any CSRF token in any user's session can be used in another user's session. CSRF tokens should not be valid in this situation.

CVE-2022-0731 [MEDIUM] CWE-284 CVE-2022-0731: Improper Access Control (IDOR) in GitHub repository dolibarr/dolibarr prior to 16.0. Improper Access Control (IDOR) in GitHub repository dolibarr/dolibarr prior to 16.0.

CVE-2021-47779 [MEDIUM] CWE-79 CVE-2021-47779: Dolibarr ERP-CRM 14.0.2 contains a stored cross-site scripting vulnerability in the ticket creation Dolibarr ERP-CRM 14.0.2 contains a stored cross-site scripting vulnerability in the ticket creation module that allows low-privilege users to inject malicious scripts. Attackers can craft a specially designed ticket message with embedded JavaScript that triggers when an administrator copies the text, potentially enabling privilege escalation.

CVE-2017-8879 [MEDIUM] CWE-287 CVE-2017-8879: Dolibarr ERP/CRM 4.0.4 allows password changes without supplying the current password, which makes i Dolibarr ERP/CRM 4.0.4 allows password changes without supplying the current password, which makes it easier for physically proximate attackers to obtain access via an unattended workstation.

CVE-2024-23817 [MEDIUM] CWE-79 CVE-2024-23817: Dolibarr is an enterprise resource planning (ERP) and customer relationship management (CRM) softwar Dolibarr is an enterprise resource planning (ERP) and customer relationship management (CRM) software package. Version 18.0.4 has a HTML Injection vulnerability in the Home page of the Dolibarr Application. This vulnerability allows an attacker to inject arbitrary HTML tags and manipulate the rendered content in the application's response. Specifical

CVE-2020-13240 [MEDIUM] CWE-276 CVE-2020-13240: The DMS/ECM module in Dolibarr 11.0.4 allows users with the 'Setup documents directories' permission The DMS/ECM module in Dolibarr 11.0.4 allows users with the 'Setup documents directories' permission to rename uploaded files to have insecure file extensions. This bypasses the .noexe protection mechanism against XSS.

CVE-2022-30875 [MEDIUM] CWE-79 CVE-2022-30875: Dolibarr 12.0.5 is vulnerable to Cross Site Scripting (XSS) via Sql Error Page. Dolibarr 12.0.5 is vulnerable to Cross Site Scripting (XSS) via Sql Error Page.

CVE-2019-11199 [MEDIUM] CWE-79 CVE-2019-11199: Dolibarr ERP/CRM 9.0.1 was affected by stored XSS within uploaded files. These vulnerabilities allow Dolibarr ERP/CRM 9.0.1 was affected by stored XSS within uploaded files. These vulnerabilities allowed the execution of a JavaScript payload each time any regular user or administrative user clicked on the malicious link hosted on the same domain. The vulnerabilities could be exploited by low privileged users to target administrators. The viewimage.p

CVE-2019-16687 [MEDIUM] CWE-79 CVE-2019-16687: Dolibarr 9.0.5 has stored XSS in a User Profile in a Signature section to card.php. A user with the Dolibarr 9.0.5 has stored XSS in a User Profile in a Signature section to card.php. A user with the "Create/modify other users, groups and permissions" privilege can inject script and can also achieve privilege escalation.

CVE-2019-16688 [MEDIUM] CWE-79 CVE-2019-16688: Dolibarr 9.0.5 has stored XSS in an Email Template section to mails_templates.php. A user with no pr Dolibarr 9.0.5 has stored XSS in an Email Template section to mails_templates.php. A user with no privileges can inject script to attack the admin. (This stored XSS can affect all types of user privilege from Admin to users with no permissions.)

CVE-2022-22293 [MEDIUM] CWE-79 CVE-2022-22293: admin/limits.php in Dolibarr 7.0.2 allows HTML injection, as demonstrated by the MAIN_MAX_DECIMALS_T admin/limits.php in Dolibarr 7.0.2 allows HTML injection, as demonstrated by the MAIN_MAX_DECIMALS_TOT parameter.

CVE-2013-2092 [MEDIUM] CWE-79 CVE-2013-2092: Cross-site Scripting (XSS) in Dolibarr ERP/CRM 3.3.1 allows remote attackers to inject arbitrary web Cross-site Scripting (XSS) in Dolibarr ERP/CRM 3.3.1 allows remote attackers to inject arbitrary web script or HTML in functions.lib.php.

CVE-2020-7996 [MEDIUM] CWE-79 CVE-2020-7996: htdocs/user/passwordforgotten.php in Dolibarr 10.0.6 allows XSS via the Referer HTTP header. htdocs/user/passwordforgotten.php in Dolibarr 10.0.6 allows XSS via the Referer HTTP header.

CVE-2019-17223 [MEDIUM] CWE-79 CVE-2019-17223: There is HTML Injection in the Note field in Dolibarr ERP/CRM 10.0.2 via user/note.php. There is HTML Injection in the Note field in Dolibarr ERP/CRM 10.0.2 via user/note.php.

CVE-2019-1010016 [MEDIUM] CWE-79 CVE-2019-1010016: Dolibarr 6.0.4 is affected by: Cross Site Scripting (XSS). The impact is: Cookie stealing. The compo Dolibarr 6.0.4 is affected by: Cross Site Scripting (XSS). The impact is: Cookie stealing. The component is: htdocs/product/stats/card.php. The attack vector is: Victim must click a specially crafted link sent by the attacker.

CVE-2023-5323 [MEDIUM] CWE-79 CVE-2023-5323: Cross-site Scripting (XSS) - Generic in GitHub repository dolibarr/dolibarr prior to 18.0. Cross-site Scripting (XSS) - Generic in GitHub repository dolibarr/dolibarr prior to 18.0.