CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 0CVE-2018-19998
https://notcve.org/view.php?id=CVE-2018-19998
03 Jan 2019 — SQL injection vulnerability in user/card.php in Dolibarr version 8.0.2 allows remote authenticated users to execute arbitrary SQL commands via the employee parameter. Una vulnerabilidad de inyección SQL basada en errores en la versión 8.0.2 de Dolibarr permite a los atacantes remotos autenticados ejecutar comandos SQL arbitrarios mediante el parámetro "employee". • https://github.com/Dolibarr/dolibarr/commit/2b088a73c121a52e006c0d76ea4da7ffeb7b4f4a • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 0CVE-2018-13448
https://notcve.org/view.php?id=CVE-2018-13448
08 Jul 2018 — SQL injection vulnerability in product/card.php in Dolibarr ERP/CRM version 7.0.3 allows remote attackers to execute arbitrary SQL commands via the country_id parameter. Una vulnerabilidad de inyección SQL en product/card.php en Dolibarr ERP/CRM 7.0.3 permite que atacantes remotos ejecuten comandos SQL arbitrarios mediante el parámetro country_id. • https://github.com/Dolibarr/dolibarr/commit/36402c22eef49d60edd73a2f312f8e28fe0bd1cb • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 0CVE-2018-13450
https://notcve.org/view.php?id=CVE-2018-13450
08 Jul 2018 — SQL injection vulnerability in product/card.php in Dolibarr ERP/CRM version 7.0.3 allows remote attackers to execute arbitrary SQL commands via the status_batch parameter. Una vulnerabilidad de inyección SQL en product/card.php en Dolibarr ERP/CRM 7.0.3 permite que atacantes remotos ejecuten comandos SQL arbitrarios mediante el parámetro status_batch. • https://github.com/Dolibarr/dolibarr/commit/36402c22eef49d60edd73a2f312f8e28fe0bd1cb • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 0CVE-2018-13449
https://notcve.org/view.php?id=CVE-2018-13449
08 Jul 2018 — SQL injection vulnerability in product/card.php in Dolibarr ERP/CRM version 7.0.3 allows remote attackers to execute arbitrary SQL commands via the statut_buy parameter. Una vulnerabilidad de inyección SQL en product/card.php en Dolibarr ERP/CRM 7.0.3 permite que atacantes remotos ejecuten comandos SQL arbitrarios mediante el parámetro statut_buy. • https://github.com/Dolibarr/dolibarr/commit/36402c22eef49d60edd73a2f312f8e28fe0bd1cb • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 0CVE-2018-13447
https://notcve.org/view.php?id=CVE-2018-13447
08 Jul 2018 — SQL injection vulnerability in product/card.php in Dolibarr ERP/CRM version 7.0.3 allows remote attackers to execute arbitrary SQL commands via the statut parameter. Una vulnerabilidad de inyección SQL en product/card.php en Dolibarr ERP/CRM 7.0.3 permite que atacantes remotos ejecuten comandos SQL arbitrarios mediante el parámetro statut. • https://github.com/Dolibarr/dolibarr/commit/36402c22eef49d60edd73a2f312f8e28fe0bd1cb • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 1CVE-2017-18260
https://notcve.org/view.php?id=CVE-2017-18260
11 Apr 2018 — Dolibarr ERP/CRM is affected by multiple SQL injection vulnerabilities in versions through 7.0.0 via comm/propal/list.php (viewstatut parameter) or comm/propal/list.php (propal_statut parameter, aka search_statut parameter). Dolibarr ERP/CRM se ha visto afectado por múltiples vulnerabilidades de inyección SQL hasta la versión 7.0.0 mediante comm/propal/list.php (parámetro viewstatut) o comm/propal/list.php (parámetro propal_statut, también conocido como search_statut). • https://www.wizlynxgroup.com/security-research-advisories/vuln/WLX-2017-010 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 5.4EPSS: 0%CPEs: 1EXPL: 1CVE-2017-18259
https://notcve.org/view.php?id=CVE-2017-18259
11 Apr 2018 — Dolibarr ERP/CRM is affected by stored Cross-Site Scripting (XSS) in versions through 7.0.0. Dolibarr ERP/CRM se ha visto afectado por Cross-Site Scripting (XSS) persistente hasta la versión 7.0.0. • https://www.wizlynxgroup.com/security-research-advisories/vuln/WLX-2017-008 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.4EPSS: 0%CPEs: 1EXPL: 1CVE-2017-9838
https://notcve.org/view.php?id=CVE-2017-9838
11 Apr 2018 — Dolibarr ERP/CRM is affected by multiple reflected Cross-Site Scripting (XSS) vulnerabilities in versions before 5.0.4: index.php (leftmenu parameter), core/ajax/box.php (PATH_INFO), product/stats/card.php (type parameter), holiday/list.php (month_create, month_start, and month_end parameters), and don/card.php (societe, lastname, firstname, address, zipcode, town, and email parameters). Dolibarr ERP/CRM se ha visto afectado por múltiples vulnerabilidades de Cross-Site Scripting (XSS) reflejado en las versi... • https://www.wizlynxgroup.com/security-research-advisories/vuln/WLX-2017-008 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 1CVE-2017-9839
https://notcve.org/view.php?id=CVE-2017-9839
11 Apr 2018 — Dolibarr ERP/CRM is affected by SQL injection in versions before 5.0.4 via product/stats/card.php (type parameter). Dolibarr ERP/CRM se ha visto afectado por una inyección SQL en las versiones anteriores a la 5.0.4 mediante product/stats/card.php (parámetro type). • https://www.wizlynxgroup.com/security-research-advisories/vuln/WLX-2017-010 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 5.4EPSS: 0%CPEs: 1EXPL: 1CVE-2017-1000509
https://notcve.org/view.php?id=CVE-2017-1000509
09 Feb 2018 — Dolibarr version 6.0.2 contains a Cross Site Scripting (XSS) vulnerability in Product details that can result in execution of javascript code. Dolibarr, en su versión 6.0.2, contiene una vulnerabilidad de Cross Site Scripting (XSS) en los detalles de producto que puede resultar en la ejecución de código JavaScript. • https://github.com/Dolibarr/dolibarr/issues/7727 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •