Multiple cross-site scripting (XSS) vulnerabilities in Dolibarr ERP/CRM 3.5 and 3.6 allow…
Priority LOW 24CWE-79Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- — Not recorded in CVSS 2.0
- Attack complexity
- Medium
- Impact type
- Cross-site scripting
- Confidentiality · integrity · availability
- None · Partial · None
- Fix status
- Fixed
Attack profile from CVSS 2.0 · NVD. Fix status from CNA and GitHub. Impact type from CWE-79.
Summary
Multiple cross-site scripting (XSS) vulnerabilities in Dolibarr ERP/CRM 3.5 and 3.6 allow remote attackers to inject arbitrary web script or HTML via the Business Search (search_nom) field to (1) htdocs/societe/societe.php or (2) htdocs/societe/admin/societe.php.
Why it matters now
EPSS 0.01923 80th percentileScored 2026-11-07
Public exploit Yes 3 exploit referencesTagged by NVD
Fix Fixed dolibarr/dolibarr (Packagist): 3.5.8
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
| — | dolibarr/dolibarr (Packagist) | 3.5.0 to before 3.5.8 | 3.5.8 | Patch available | GHSA-6fw8-vf2x-4wpm |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
- dolibarr/dolibarr (Packagist) Vendor— Affected 3.5.0 to before 3.5.8 Fixed in 3.5.8 Patch available GHSA-6fw8-vf2x-4wpm
Remediation
- Fix · GHSA-6fw8-vf2x-4wpm dolibarr/dolibarr (Packagist) Fixed in 3.5.8 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2015-3935
- 2026-10-03 Alias added: GHSA-6fw8-vf2x-4wpm
References
Exploit 3
Other 5
- https://github.com/GPCsolutions/dolibarr/commit/a7f6bbd316e9b96216e9b2c7a065c9251c9a8907
- https://github.com/Dolibarr/dolibarr/issues/4291
- https://github.com/Dolibarr/dolibarr/issues/4341
- https://github.com/dolibarr/dolibarr/commit/a7f6bbd316e9b96216e9b2c7a065c9251c9a8907
- https://web.archive.org/web/20210122162903/http://www.securityfocus.com/bid/74926
More Dolibarr vulnerabilities
- TI-2018-07157 SQL injection vulnerability in Dolibarr before 7.0.2 allows remote attackers to execute… CVSS 3.0CRITICAL 9.8
- TI-2018-07158 Cross-site scripting (XSS) vulnerability in Dolibarr before 7.0.2 allows remote attackers… CVSS 3.0MEDIUM 6.1
- TI-2020-11130 Dolibarr before 11.0.5 allows low-privilege users to upload files of dangerous types… CVSS 3.1HIGH 8.8
- TI-2019-13844 Dolibarr ERP/CRM 3.0 through 10.0.3 allows XSS via the qty parameter to product/fournisseurs.php (product price screen). CVSS 3.1CRITICAL 9.8
- TI-2018-06539 SQL Injection vulnerability in Dolibarr before version 7.0.2 allows remote attackers to… CVSS 3.1CRITICAL 9.8
- TI-2018-12038 An issue was discovered in Dolibarr through 7.0.0. CVSS 3.0CRITICAL 9.8
Sources
- CVE-2015-3935 · CVE Program
- CVE-2015-3935 · NVD
- FIRST EPSS
- GHSA-6fw8-vf2x-4wpm · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences