Description
Multiple cross-site scripting (XSS) vulnerabilities in Dolibarr ERP/CRM 6.0.0 allow remote authenticated users to inject arbitrary web script or HTML via the (1) CompanyName, (2) CompanyAddress, (3) CompanyZip, (4) CompanyTown, (5) Fax, (6) EMail, (7) Web, (8) ManagingDirectors, (9) Note, (10) Capital, (11) ProfId1, (12) ProfId2, (13) ProfId3, (14) ProfId4, (15) ProfId5, or (16) ProfId6 parameter to htdocs/admin/company.php.
Remediation
References
Related Vulnerabilities
WordPress Plugin User Submitted Posts Arbitrary File Upload (20190426)
WordPress Plugin Easy Preloader Cross-Site Scripting (1.0.0)
WordPress Plugin Weekly Schedule Cross-Site Scripting (3.4.2)
Oracle JRE CVE-2017-10285 Vulnerability (CVE-2017-10285)
TwistedHTTP Request Splitting Vulnerability (CVE-2020-10109)