Reflected Cross-Site Scripting (XSS) in Dolibarr

MEDIUM 4.6CVE-2024-34051 · GHSA-hv2j-6654-x74q · Published 03/06/2024 · updated 17/06/2026

Package	Affected versions	Patched versions
dolibarr/dolibarr Packagist	`< 19.0.2`	`19.0.2`

Description

A Reflected Cross-site scripting (XSS) vulnerability located in htdocs/compta/paiement/card.php of Dolibarr before 19.0.2 allows remote attackers to inject arbitrary web script or HTML via a crafted payload injected into the facid parameter.

NVD description

References

nvd.nist.gov/vuln/detail/CVE-2024-34051 · ADVISORY
Dolibarr/dolibarr commit 3a3ccc2 · WEB
blog.smarttecs.com/posts/2024-004-cve-2024-34051 · WEB
Dolibarr/dolibarr · PACKAGE
blog.smarttecs.com/posts/2024-004-cve-2024-34051

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free