Dolibarr Cross-site scripting (XSS) vulnerability

MEDIUM 6.1CVE-2018-10095 · GHSA-p2fm-8rhj-58fr · Published 22/05/2018 · updated 17/06/2026

Package	Affected versions	Patched versions
dolibarr/dolibarr Packagist	`< 7.0.2`	`7.0.2`
dolibarr dolibarr	`< 7.0.2`	`7.0.2`

Description

Cross-site scripting (XSS) vulnerability in Dolibarr before 7.0.2 allows remote attackers to inject arbitrary web script or HTML via the foruserlogin parameter to adherents/cartes/carte.php.

NVD description

Cross-site scripting (XSS) vulnerability in Dolibarr before 7.0.2 allows remote attackers to inject arbitrary web script or HTML via the foruserlogin parameter to adherents/cartes/carte.php.

References

nvd.nist.gov/vuln/detail/CVE-2018-10095 · ADVISORY
Dolibarr/dolibarr commit 1dc466e · WEB
Dolibarr/dolibarr · PACKAGE
Dolibarr/dolibarr · WEB
sysdream.com/news/lab/2018-05-21-cve-2018-10095-dolibarr-xss-injection-vulnerability · WEB
openwall.com/lists/oss-security/2018/05/21/3 · WEB
sysdream.com/news/lab/2018-05-21-cve-2018-10095-dolibarr-xss-injection-vulnerability · Third Party Advisory

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free