Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
5.4
CVE-2020-9016: Dolibarr ERP and CRM Allows Malicious Code Injection
CVE-2020-9016 · published 6 years ago
Summary
Dolibarr ERP and CRM has a security weakness that could allow an attacker to inject malicious code into the system. This could happen if a user clicks on a specially crafted link or visits a malicious website. To stay safe, update Dolibarr to the latest version or patch level.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| composer | dolibarr | dolibarr | <= 11.0.0 |
| Ubuntu:Pro:16.04:LTS | canonical | dolibarr | All versions |
| – | dolibarr | dolibarr_erp\/crm |
11.0.0 cpe:2.3:a:dolibarr:dolibarr_erp\/crm:11.0.0:-:*:*:*:*:*:* |
Original advisory text
Dolibarr ERP and CRM contain XSS Vulnerability
Dolibarr 11.0 allows XSS via the joinfiles, topic, or code parameter, or the HTTP Referer header.
References
- https://nvd.nist.gov/vuln/detail/CVE-2020-9016
- https://web.archive.org/web/20201203085334/https://therealcoiffeur.github.io/c10...
- https://github.com/advisories/GHSA-jh69-6vv2-wfp5
- https://code610.blogspot.com/2020/02/this-time-i-tried-to-check-one-of.html Exploit Third Party Advisory
- https://ubuntu.com/security/CVE-2020-9016 Third Party Advisory
- https://www.cve.org/CVERecord?id=CVE-2020-9016 Third Party Advisory
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit (estimated)
- Gives an attacker partial control (estimated)
Type
CWE-79Cross-site Scripting (XSS)
Timeline
Published16 Feb 2020
Updated3 Nov 2026
First seen6 Mar 2026
Track software like this
Free during beta