p PatchFirst

CVE-2016-1912

CVE-2016-1912

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Multiple cross-site scripting (XSS) vulnerabilities in Dolibarr ERP/CRM 3.8.3 allow remote authenticated users to inject arbitrary web script or HTML via the (1) lastname, (2) firstname, (3) email, (4) job, or (5) signature parameter to htdocs/user/card.php.

CVSS 5.4 · Medium · EPSS 1.4%

Published
Updated

Stack: php

Affected products and versions

  • n/a

    Versions
    • n/a: Affected

    No fix published

  • dolibarr/dolibarr Packagist

    Versions
    • 3.6.0
    • 3.6.0-beta
    • 3.6.1
    • 3.6.2
    • 3.6.3
    • 3.6.4
    • 3.6.5
    • 3.6.6
    • 3.7.0
    • 3.7.1
    • 3.7.2
    • 3.7.3
    • 3.7.4
    • 3.8.0
    • 3.8.0-beta
    • 3.8.1
    • 3.8.2
    • 3.8.3
    Affected ranges
    • ECOSYSTEM: ≤ 3.8.3

    No fix published

Original sources

Check your server →