medium6.1Public exploit code
CVE-2019-16197
In htdocs/societe/card.php in Dolibarr 10.0.1, the value of the User-Agent HTTP header is copied into the HTML document as plain text between tags, leading to …
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- Dolibarr ERP-CRM 10.0.1 - 'User-Agent' Cross-Site Scripting2019-09-13 · webapps · php
Impact
In htdocs/societe/card.php in Dolibarr 10.0.1, the value of the User-Agent HTTP header is copied into the HTML document as plain text between tags, leading to XSS.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Dolibarr | Dolibarr Erp\/Crm | Version 10.0.1 |