Description

Multiple cross-site scripting (XSS) vulnerabilities in Dolibarr 3.1.0 RC and probably earlier allow remote attackers to inject arbitrary web script or HTML via the PATH_INFO to (1) index.php, (2) admin/boxes.php, (3) comm/clients.php, (4) commande/index.php; and the optioncss parameter to (5) admin/ihm.php and (6) user/home.php.

Remediation

References

CVE-2011-4814

Related Vulnerabilities

WordPress Plugin Loco Translate Unspecified Vulnerability (2.5.4)

Apache Tomcat Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2007-1358)

WordPress Plugin WORDPRESS VIDEO GALLERY Multiple Cross-Site Request Forgery Vulnerabilities (2.8)

Jetty Allocation of Resources Without Limits or Throttling Vulnerability (CVE-2024-8184)

WordPress Plugin Crafty Social Buttons Cross-Site Scripting (1.5.6)

Severity

Medium

Classification

CVE-2011-4814 CWE-707

Tags

Missing Update Known Vulnerabilities