Description

Multiple cross-site scripting (XSS) vulnerabilities in Dolibarr 3.1.0 RC and probably earlier allow remote attackers to inject arbitrary web script or HTML via the PATH_INFO to (1) index.php, (2) admin/boxes.php, (3) comm/clients.php, (4) commande/index.php; and the optioncss parameter to (5) admin/ihm.php and (6) user/home.php.

Remediation

References

CVE-2011-4814

Related Vulnerabilities

Piwigo Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Vulnerability (CVE-2017-9463)

OpenSSL Excessive Iteration Vulnerability (CVE-2023-3817)

WordPress Plugin Light Post 'abspath' Parameter Remote File Include (1.4)

WordPress 6.1.x Shortcode Execution (6.1 - 6.1.2)

Oracle JRE CVE-2013-0429 Vulnerability (CVE-2013-0429)

Severity

Medium

Classification

CVE-2011-4814 CWE-707

Tags

Missing Update Known Vulnerabilities