CVE-2018-10095

Cross-site scripting (XSS) vulnerability in Dolibarr before 7.0.2 allows remote attackers to inject arbitrary web script or HTML via the foruserlogin parameter to adherents/cartes/carte.php.

CVSS v3.0 NVD

6.1 MEDIUMCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

CVSS v2.0 NVD

4.3 MEDIUMAV:N/AC:M/Au:N/C:N/I:P/A:N

EPSS

86.77% chance of exploitation in the next 30 days, 100th percentile

Nuclei

medium · CWE-79

Published

2018-05-22

Updated

2024-08-05

Nuclei templates (1)

• projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-10095.yaml

Security advisories

• Dolibarr/dolibarr/blob/7.0.2/ChangeLog
• https://sysdream.com/news/lab/2018-05-21-cve-2018-10095-dolibarr-xss-injection-vulnerabil…
• advisories/GHSA-p2fm-8rhj-58fr

References

• CVE Record
• NVD entry