Back to CVE Browser

CVE-2019-19212

CRITICAL

9.8

CVSS Severity Score

EPSS Score0.1200%

EPSS Percentile14.36th

PublishedMar 16, 2020

Last ModifiedNov 21, 2024

Vulnerability Description

Dolibarr ERP/CRM 3.0 through 10.0.3 allows XSS via the qty parameter to product/fournisseurs.php (product price screen).

Affected Platforms (CPE)

📦

Dolibarr

Dolibarr

>= 3.0.0 and <= 10.0.3

References & Advisories

🔗 https://herolab.usd.de/en/security-advisories/

🔗 https://herolab.usd.de/security-advisories/usd-2019-0054/

🔗 https://www.dolibarr.org/forum/dolibarr-changelogs

🔗 https://herolab.usd.de/en/security-advisories/

🔗 https://herolab.usd.de/security-advisories/usd-2019-0054/

🔗 https://www.dolibarr.org/forum/dolibarr-changelogs

Related Vulnerabilities

CVE-2020-79959.8

The htdocs/index.php?mainmenu=home login page in Dolibarr 10.0.6 allows an unlimited rate of failed authentication attempts.

CVE-2018-168099.8

An issue was discovered in Dolibarr through 7.0.0. expensereport/card.php in the expense reports module allows SQL injection via t...

CVE-2018-253579.8

Dolibarr ERP CRM 7.0.3 contains a remote code execution vulnerability that allows unauthenticated attackers to execute arbitrary c...

CVE-2021-338169.8

The website builder module in Dolibarr 13.0.2 allows remote PHP code execution because of an incomplete protection mechanism in wh...