Filtered by vendor Dolibarr Subscriptions
Filtered by product Dolibarr Erp\/crm Subscriptions
Total 87 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2019-11200 1 Dolibarr 1 Dolibarr Erp\/crm 2020-08-24 N/A
Dolibarr ERP/CRM 9.0.1 provides a web-based functionality that backs up the database content to a dump file. However, the application performs insufficient checks on the export parameters to mysqldump, which can lead to execution of arbitrary binaries on the server. (Malicious binaries can be uploaded by abusing other functionalities of the application.)
CVE-2019-11199 1 Dolibarr 1 Dolibarr Erp\/crm 2019-08-05 N/A
Dolibarr ERP/CRM 9.0.1 was affected by stored XSS within uploaded files. These vulnerabilities allowed the execution of a JavaScript payload each time any regular user or administrative user clicked on the malicious link hosted on the same domain. The vulnerabilities could be exploited by low privileged users to target administrators. The viewimage.php page did not perform any contextual output encoding and would display the content within the uploaded file with a user-requested MIME type.
CVE-2019-11201 1 Dolibarr 1 Dolibarr Erp\/crm 2019-08-05 N/A
Dolibarr ERP/CRM 9.0.1 provides a module named website that provides for creation of public websites with a WYSIWYG editor. It was identified that the editor also allowed inclusion of dynamic code, which can lead to code execution on the host machine. An attacker has to check a setting on the same page, which specifies the inclusion of dynamic content. Thus, a lower privileged user of the application can execute code under the context and permissions of the underlying web server.
CVE-2017-9839 1 Dolibarr 1 Dolibarr Erp\/crm 2018-05-16 N/A
Dolibarr ERP/CRM is affected by SQL injection in versions before 5.0.4 via product/stats/card.php (type parameter).
CVE-2017-9838 1 Dolibarr 1 Dolibarr Erp\/crm 2018-05-16 N/A
Dolibarr ERP/CRM is affected by multiple reflected Cross-Site Scripting (XSS) vulnerabilities in versions before 5.0.4: index.php (leftmenu parameter), core/ajax/box.php (PATH_INFO), product/stats/card.php (type parameter), holiday/list.php (month_create, month_start, and month_end parameters), and don/card.php (societe, lastname, firstname, address, zipcode, town, and email parameters).
CVE-2017-18259 1 Dolibarr 1 Dolibarr Erp\/crm 2018-05-16 N/A
Dolibarr ERP/CRM is affected by stored Cross-Site Scripting (XSS) in versions through 7.0.0.
CVE-2017-18260 1 Dolibarr 1 Dolibarr Erp\/crm 2018-05-16 N/A
Dolibarr ERP/CRM is affected by multiple SQL injection vulnerabilities in versions through 7.0.0 via comm/propal/list.php (viewstatut parameter) or comm/propal/list.php (propal_statut parameter, aka search_statut parameter).