Login Request a demo
Unscored severity · published Dec 14, 2011
CVE-2011-4814
Multiple cross-site scripting (XSS) vulnerabilities in Dolibarr 3.1.0 RC and probably earlier allow remote attackers to inject arbitrary web script or HTML via the PATH_INFO to…
–
CVSS
5.5%
EPSS
No
On KEV
Description
Multiple cross-site scripting (XSS) vulnerabilities in Dolibarr 3.1.0 RC and probably earlier allow remote attackers to inject arbitrary web script or HTML via the PATH_INFO to (1) index.php, (2) admin/boxes.php, (3) comm/clients.php, (4) commande/index.php; and the optioncss parameter to (5) admin/ihm.php and (6) user/home.php.
Exploitation
Is it being used?
Exploit prediction (EPSS)5.5% · higher than 93% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
DE
Dolibarr Erp/crm · Dolibarr
through 3.1.0; 2.5.0; 2.6.0; 2.6.1; 2.7.0; 2.7.1; +5 more · source: NVD
Affected product
DE
Dolibarr Erp/crm
Dolibarr
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2011-4814
CVE.org
https://www.cve.org/CVERecord?id=CVE-2011-4814
Broken Link
http://www.osvdb.org/77339
Broken Link
http://www.securityfocus.com/archive/1/520619/100/0/threaded
Broken Link
http://www.securityfocus.com/bid/50777
Exploit
https://github.com/Dolibarr/dolibarr/commit/63820ab37537fdff842539425b2bf2881f0d8e91
Exploit
https://github.com/Dolibarr/dolibarr/commit/762f98ab4137749d0993612b4e3544a4207e78a1
Exploit
https://github.com/Dolibarr/dolibarr/commit/c539155d6ac2f5b6ea75b87a16f298c0090e535a
More from Dolibarr Erp/crm
9.8
CVE-2018-25357
Dolibarr ERP CRM 7.0.3 Remote Code Execution via install/step1.php
9.8
CVE-2022-4093
SQL injection attacks can result in unauthorized access to sensitive data, such as passwords, credit card details, or personal user information
9.8
CVE-2022-43138
Dolibarr Open Source ERP & CRM for Business before v14.0.1 allows attackers to escalate privileges via a crafted API
9.8
CVE-2022-40871
Dolibarr ERP & CRM <=15.0.3 is vulnerable to Eval injection
9.8
CVE-2022-0224
dolibarr is vulnerable to Improper Neutralization of Special Elements used in an SQL Command