Description
Dolibarr ERP/CRM before 10.0.3 allows XSS because uploaded HTML documents are served as text/html despite being renamed to .noexe files.
Remediation
References
Related Vulnerabilities
WordPress Plugin Custom Permalinks SQL Injection (1.1)
WordPress Plugin Cross-RSS Directory Traversal (1.7)
Apache Tomcat Improper Access Control Vulnerability (CVE-2014-7810)
WordPress Plugin WPBook Cross-Site Request Forgery (2.7)
WordPress Plugin Joy Of Text Lite-SMS messaging for WordPress SQL Injection (2.3.0)