Description
Multiple cross-site scripting (XSS) vulnerabilities in Dolibarr 3.1.0 RC and probably earlier allow remote attackers to inject arbitrary web script or HTML via the PATH_INFO to (1) index.php, (2) admin/boxes.php, (3) comm/clients.php, (4) commande/index.php; and the optioncss parameter to (5) admin/ihm.php and (6) user/home.php.
Remediation
References
Related Vulnerabilities
Coppermine Exposure of Sensitive Information to an Unauthorized Actor Vulnerability (CVE-2008-7187)
Oracle JRE CVE-2012-4416 Vulnerability (CVE-2012-4416)
WordPress Plugin Cart66 Lite::WordPress Ecommerce Cross-Site Scripting (1.5.4)
Apache HTTP Server Session Fixation Vulnerability (CVE-2001-1534)
ownCloud Improper Access Control Vulnerability (CVE-2016-9468)