GHSA-6fw8-vf2x-4wpmMedium

Dolibarr ERP and CRM contain Cross-site Scripting Vulnerability

Published
May 17, 2022
Last Modified
August 3, 2023

🔗 CVE IDs covered (1)

CVE-2015-3935 →

📋 Description

Multiple cross-site scripting (XSS) vulnerabilities in Dolibarr ERP/CRM 3.5 and 3.6 allow remote attackers to inject arbitrary web script or HTML via the Business Search (search_nom) field to (1) htdocs/societe/societe.php or (2) htdocs/societe/admin/societe.php.

🎯 Affected products1

  • composer/dolibarr/dolibarr:>= 3.5.0, < 3.5.8

🔗 References (9)