Dolibarr Cross-site Scripting via the qty parameter in product/fournisseurs.php

CRITICAL 9.8CVE-2019-19212 · GHSA-pm57-926c-28mr · Published 16/03/2020 · updated 17/06/2026

In short

CVE-2019-19212 is a CRITICAL (CVSS 9.8) vulnerability affecting dolibarr/dolibarr, dolibarr (dolibarr).
Chance of exploitation in the next 30 days (EPSS): 3.9%, higher than 90.2% of all vulnerabilities.
No patched version is listed yet: follow the vendor's advisory in References.

Package	Affected versions	Patched versions
dolibarr/dolibarr Packagist	`≥ 3.0, ≤ 10.0.3`	No fix yet
dolibarr dolibarr	`≥ 3.0.0, ≤ 10.0.3`	No fix yet

Dolibarr ERP/CRM 3.0 through 10.0.3 allows XSS via the qty parameter to product/fournisseurs.php (product price screen).

NVD description

Dolibarr ERP/CRM 3.0 through 10.0.3 allows XSS via the qty parameter to product/fournisseurs.php (product price screen).

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Package

Affected versions

Patched versions

Packagist

≥ 3.0, ≤ 10.0.3

No fix yet

≥ 3.0.0, ≤ 10.0.3

No fix yet

More vulnerabilities in dolibarr/dolibarr

See all →