GHSA-m9q9-4m25-23gcMediumCVSS 5.4

Dolibarr Cross-site Scripting in a User Profile in a Signature section

Published
May 24, 2022
Last Modified
April 24, 2024

🔗 CVE IDs covered (1)

CVE-2019-16687 →

📋 Description

Dolibarr 9.0.5 has stored XSS in a User Profile in a Signature section to card.php. A user with the "Create/modify other users, groups and permissions" privilege can inject script and can also achieve privilege escalation.

🎯 Affected products1

  • composer/dolibarr/dolibarr:= 9.0.5

🔗 References (3)