CVSS: 5.4EPSS: 0%CPEs: 1EXPL: 1CVE-2017-9838
https://notcve.org/view.php?id=CVE-2017-9838
Dolibarr ERP/CRM is affected by multiple reflected Cross-Site Scripting (XSS) vulnerabilities in versions before 5.0.4: index.php (leftmenu parameter), core/ajax/box.php (PATH_INFO), product/stats/card.php (type parameter), holiday/list.php (month_create, month_start, and month_end parameters), and don/card.php (societe, lastname, firstname, address, zipcode, town, and email parameters). Dolibarr ERP/CRM se ha visto afectado por múltiples vulnerabilidades de Cross-Site Scripting (XSS) reflejado en las versiones anteriores a la 5.0.4: index.php (parámetro leftmenu), core/ajax/box.php (PATH_INFO), product/stats/card.php (parámetro type), holiday/list.php (parámetros month_create, month_start y month_end) y don/card.php (parámetros societe, lastname, firstname, address, zipcode, town e email). • https://www.wizlynxgroup.com/security-research-advisories/vuln/WLX-2017-008 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 1CVE-2017-9839
https://notcve.org/view.php?id=CVE-2017-9839
Dolibarr ERP/CRM is affected by SQL injection in versions before 5.0.4 via product/stats/card.php (type parameter). Dolibarr ERP/CRM se ha visto afectado por una inyección SQL en las versiones anteriores a la 5.0.4 mediante product/stats/card.php (parámetro type). • https://www.wizlynxgroup.com/security-research-advisories/vuln/WLX-2017-010 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 5.4EPSS: 0%CPEs: 1EXPL: 1CVE-2017-1000509
https://notcve.org/view.php?id=CVE-2017-1000509
Dolibarr version 6.0.2 contains a Cross Site Scripting (XSS) vulnerability in Product details that can result in execution of javascript code. Dolibarr, en su versión 6.0.2, contiene una vulnerabilidad de Cross Site Scripting (XSS) en los detalles de producto que puede resultar en la ejecución de código JavaScript. • https://github.com/Dolibarr/dolibarr/issues/7727 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 1CVE-2017-17971
https://notcve.org/view.php?id=CVE-2017-17971
The test_sql_and_script_inject function in htdocs/main.inc.php in Dolibarr ERP/CRM 6.0.4 blocks some event attributes but neither onclick nor onscroll, which allows XSS. La función test_sql_and_script_inject en htdocs/main.inc.php en Dolibarr ERP/CRM 6.0.4 bloquea algunos atributos de evento, pero no bloquea onclick ni onscroll. Esto permite Cross-Site Scripting (XSS). • https://github.com/Dolibarr/dolibarr/issues/8000 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 0CVE-2017-17899
https://notcve.org/view.php?id=CVE-2017-17899
SQL injection vulnerability in adherents/subscription/info.php in Dolibarr ERP/CRM version 6.0.4 allows remote attackers to execute arbitrary SQL commands via the rowid parameter. Una vulnerabilidad de inyección SQL en adherents/subscription/info.php en Dolibarr ERP/CRM versión 6.0.4 permite que atacantes remotos ejecuten comandos SQL arbitrarios mediante el parámetro rowid. • https://github.com/Dolibarr/dolibarr/commit/4a5988accbb770b74105baacd5a034689272128c • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •