| Package | Affected versions | Patched versions |
|---|---|---|
| dolibarr/dolibarr | = 11.0.4 | |
| dolibarr erp/crm | = 11.0.4 |
The DMS/ECM module in Dolibarr 11.0.4 renders user-uploaded .html files in the browser when the attachment parameter is removed from the direct download link. This causes XSS.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free