Vulnerabilities

Filters

Reset all

2 selected

32 records

Sort

Vendor: Dolibarr Component: Dolibarr Clear all filters

TI-2021-18678 CVE-2021-42220 · GHSA-jqfp-m5f8-vg28

A Cross Site Scripting (XSS) vulnerability exists in Dolibarr before 14.0.3 via the…

LOW 26

A Cross Site Scripting (XSS) vulnerability exists in Dolibarr before 14.0.3 via the ticket creation flow.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.0098 Published 2021-12-15 Fixed in 14.0.3 CWE-79

TI-2021-07962 CVE-2021-25956 · GHSA-fjqg-w8g6-hhq8

Improper User Access Control in "Dolibarr" Leads to Account Takeover

LOW 33

In “Dolibarr” application, v3.3.beta1_20121221 to v13.0.2 have “Modify” access for admin level users to change other user’s details but fails to validate already existing “Login” name, while renaming the user “Login”.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.00935 Published 2021-08-17 Fixed in 14.0.0 CWE-284

TI-2021-07963 CVE-2021-25957 · GHSA-c32w-3cqh-f6jx

Account Takeover in "Dolibarr" via Password Reset Functionality

MEDIUM 40

In “Dolibarr” application, v2.8.1 to v13.0.2 are vulnerable to account takeover via password reset functionality.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.01058 Published 2021-08-17 Fixed in 14.0.0 CWE-640

TI-2021-07961 CVE-2021-25955 · GHSA-cpv8-6xgr-rmf6

Stored XSS in “Dolibarr” leads to privilege escalation

MEDIUM 41

In “Dolibarr ERP CRM”, WYSIWYG Editor module, v2.8.1 to v13.0.2 are affected by a stored XSS vulnerability that allows low privileged application users to store malicious scripts in the “Private Note” field at “/adherent…

CVSS 3.1CRITICAL 9.0 Network Low privileges User interaction EPSS 0.00893 Published 2021-08-15 Fixed in 14.0.0 CWE-79

TI-2021-07960 CVE-2021-25954 · GHSA-vxhc-c4qm-647p

Improper Access Control in “Dolibarr”

LOW 21

In “Dolibarr” application, 2.8.1 to 13.0.4 don’t restrict or incorrectly restricts access to a resource from an unauthorized actor.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00702 Published 2021-08-09 Fixed in 14.0.0 CWE-284

TI-2020-11130 CVE-2020-14209 · GHSA-2gcp-xwxg-hqg3

Dolibarr before 11.0.5 allows low-privilege users to upload files of dangerous types…

MEDIUM 60

Dolibarr before 11.0.5 allows low-privilege users to upload files of dangerous types, leading to arbitrary code execution.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.27482 Published 2020-09-02 Fixed in 11.0.5 CWE-434

TI-2020-11122 CVE-2020-14201 · GHSA-25h3-mw3p-w8r7

Dolibarr CRM before 11.0.5 allows privilege escalation.

LOW 32

Dolibarr CRM before 11.0.5 allows privilege escalation.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.01629 Published 2020-08-21 Fixed in 11.0.5 CWE-269

TI-2020-11304 CVE-2020-14443 · GHSA-8v7v-6mmm-xjxm

A SQL injection vulnerability in accountancy/customer/card.php in Dolibarr 11.0.3 allows…

MEDIUM 40

A SQL injection vulnerability in accountancy/customer/card.php in Dolibarr 11.0.3 allows remote authenticated users to execute arbitrary SQL commands via the id parameter.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.01147 Published 2020-06-18 Fixed in 11.0.5 CWE-89

TI-2020-10299 CVE-2020-13094 · GHSA-cxvr-r92m-q9hw

Dolibarr before 11.0.4 allows XSS.

LOW 27

Dolibarr before 11.0.4 allows XSS.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.01145 Published 2020-05-18 Fixed in 11.0.4 CWE-79

TI-2020-10074 CVE-2020-12669 · GHSA-rg8m-84jf-9367

core/get_menudiv.php in Dolibarr before 11.0.4 allows remote authenticated attackers to…

MEDIUM 42

core/get_menudiv.php in Dolibarr before 11.0.4 allows remote authenticated attackers to bypass intended access restrictions via a non-alphanumeric menu parameter.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.01955 Published 2020-05-06 Fixed in 12.0.0 CWE-20

TI-2019-13844 CVE-2019-19212 · GHSA-pm57-926c-28mr

Dolibarr ERP/CRM 3.0 through 10.0.3 allows XSS via the qty parameter to product/fournisseurs.php (product price screen).

MEDIUM 49

Dolibarr ERP/CRM 3.0 through 10.0.3 allows XSS via the qty parameter to product/fournisseurs.php (product price screen).

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.03885 Published 2020-03-16 No fix listed CWE-79

TI-2019-13843 CVE-2019-19211 · GHSA-gfhf-2xr5-2fvw

Dolibarr ERP/CRM before 10.0.3 has an Insufficient Filtering issue that can lead to user/card.php XSS.

LOW 31

Dolibarr ERP/CRM before 10.0.3 has an Insufficient Filtering issue that can lead to user/card.php XSS.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.01669 Published 2020-03-16 Fixed in 10.0.3 CWE-79

TI-2019-13842 CVE-2019-19210 · GHSA-87r3-4gc8-f897

Dolibarr ERP/CRM before 10.0.3 allows XSS because uploaded HTML documents are served as…

LOW 26

Dolibarr ERP/CRM before 10.0.3 allows XSS because uploaded HTML documents are served as text/html despite being renamed to .noexe files.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00928 Published 2020-03-16 Fixed in 10.0.3 CWE-79

TI-2019-13841 CVE-2019-19209 · GHSA-jh3j-xfv2-f9m9

Dolibarr ERP/CRM before 10.0.3 allows SQL Injection.

LOW 37

Dolibarr ERP/CRM before 10.0.3 allows SQL Injection.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.02083 Published 2020-03-16 Fixed in 10.0.3 CWE-89

TI-2018-12038 CVE-2018-16809 · GHSA-h34q-878w-w96r

An issue was discovered in Dolibarr through 7.0.0.

MEDIUM 46

An issue was discovered in Dolibarr through 7.0.0.

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.0226 Published 2019-03-07 No fix listed CWE-89

TI-2018-12037 CVE-2018-16808 · GHSA-r3r5-fqfm-9wrh

An issue was discovered in Dolibarr through 7.0.0.

LOW 29

An issue was discovered in Dolibarr through 7.0.0.

CVSS 3.0MEDIUM 6.1 Network No auth User interaction EPSS 0.0098 Published 2019-03-07 Fixed in 7.0.1 CWE-79

TI-2018-14022 CVE-2018-19799 · GHSA-ggww-q2gv-m3g4

Dolibarr ERP/CRM through 8.0.3 has /exports/export.php?datatoexport= XSS.

LOW 35

Dolibarr ERP/CRM through 8.0.3 has /exports/export.php?datatoexport= XSS.

CVSS 3.0MEDIUM 6.1 Network No auth User interaction EPSS 0.04479 Published 2018-12-26 No fix listed CWE-79

TI-2018-07158 CVE-2018-10095 · GHSA-p2fm-8rhj-58fr

Cross-site scripting (XSS) vulnerability in Dolibarr before 7.0.2 allows remote attackers…

HIGH 69

Cross-site scripting (XSS) vulnerability in Dolibarr before 7.0.2 allows remote attackers to inject arbitrary web script or HTML via the foruserlogin parameter to adherents/cartes/carte.php.

CVSS 3.0MEDIUM 6.1 Network No auth User interaction EPSS 0.86512 Published 2018-05-22 Fixed in 7.0.2 CWE-79

TI-2018-07157 CVE-2018-10094 · GHSA-57wj-22w9-wm9r

SQL injection vulnerability in Dolibarr before 7.0.2 allows remote attackers to execute…

HIGH 79

SQL injection vulnerability in Dolibarr before 7.0.2 allows remote attackers to execute arbitrary SQL commands via vectors involving integer parameters without quotes.

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.69337 Published 2018-05-22 Fixed in 7.0.2 CWE-89

TI-2018-07155 CVE-2018-10092 · GHSA-6j62-m2vv-wc3m

The admin panel in Dolibarr before 7.0.2 might allow remote attackers to execute…

LOW 39

The admin panel in Dolibarr before 7.0.2 might allow remote attackers to execute arbitrary commands by leveraging support for updating the antivirus command and parameters used to scan file uploads.

CVSS 3.0HIGH 8.0 Network Low privileges User interaction EPSS 0.01973 Published 2018-05-22 Fixed in 7.0.2 CWE-862

TI-2018-06539 CVE-2018-9019 · GHSA-fff9-m6f6-q3mh

SQL Injection vulnerability in Dolibarr before version 7.0.2 allows remote attackers to…

MEDIUM 49

SQL Injection vulnerability in Dolibarr before version 7.0.2 allows remote attackers to execute arbitrary SQL commands via the sortfield parameter to /accountancy/admin/accountmodel.php, /accountancy/admin/categories_lis…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.03768 Published 2018-05-22 Fixed in 7.0.2 CWE-89

TI-2017-10368 CVE-2017-14242 · GHSA-jjgq-jq8g-24w4

SQL injection vulnerability in don/list.php in Dolibarr version 6.0.0 allows remote…

MEDIUM 45

SQL injection vulnerability in don/list.php in Dolibarr version 6.0.0 allows remote attackers to execute arbitrary SQL commands via the statut parameter.

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.01307 Published 2017-09-11 Fixed in 6.0.1 CWE-89

TI-2017-10367 CVE-2017-14241 · GHSA-h3vg-4x76-v28w

Cross-site scripting (XSS) vulnerability in Dolibarr ERP/CRM 6.0.0 allows remote…

LOW 26

Cross-site scripting (XSS) vulnerability in Dolibarr ERP/CRM 6.0.0 allows remote authenticated users to inject arbitrary web script or HTML via the Title parameter to htdocs/admin/menus/edit.php.

CVSS 3.0MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00722 Published 2017-09-11 Fixed in 6.0.1 CWE-79

TI-2017-10366 CVE-2017-14240 · GHSA-p9wf-x8h5-44fr

There is a sensitive information disclosure vulnerability in document.php in Dolibarr…

LOW 35

There is a sensitive information disclosure vulnerability in document.php in Dolibarr ERP/CRM version 6.0.0 via the file parameter.

CVSS 3.0HIGH 7.5 Network No auth No interaction EPSS 0.01156 Published 2017-09-11 Fixed in 6.0.1 CWE-200

TI-2017-10365 CVE-2017-14239 · GHSA-74c7-r9m3-hvj4

Multiple cross-site scripting (XSS) vulnerabilities in Dolibarr ERP/CRM 6.0.0 allow…

LOW 26

Multiple cross-site scripting (XSS) vulnerabilities in Dolibarr ERP/CRM 6.0.0 allow remote authenticated users to inject arbitrary web script or HTML via the (1) CompanyName, (2) CompanyAddress, (3) CompanyZip, (4) Compa…

CVSS 3.0MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00722 Published 2017-09-11 Fixed in 6.0.1 CWE-79