medium5.4
CVE-2019-16688
Dolibarr stored Cross-site Scripting in an Email Template section
Impact
Dolibarr 9.0.5 has stored XSS in an Email Template section to mails_templates.php. A user with no privileges can inject script to attack the admin. (This stored XSS can affect all types of user privilege from Admin to users with no permissions.)
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| composer | dolibarr/dolibarr | = 9.0.5 | none recorded |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Dolibarr | Dolibarr Erp\/Crm | Version 9.0.5 |