alexbsec/CVEs

Releases0

CVE History

CVE	Published	CVSS v3	CVSS v2
CVE-2024-37821 ↗	Jun 18, 2024Tuesday, 18 June 2024, 20:15	8.8 HIGH	—
An arbitrary file upload vulnerability in the Upload Template function of Dolibarr ERP CRM up to v19.0.1 allows attackers to execute arbitrary code via uploading a crafted .SQL file.
CVE-2024-31503 ↗	Apr 17, 2024Wednesday, 17 April 2024, 00:15	7.5 HIGH	—
Incorrect access control in Dolibarr ERP CRM versions 19.0.0 and before, allows authenticated attackers to steal victim users' session cookies and CSRF protection tokens via user interaction with a crafted web page, leading to account takeover.
CVE-2024-29477 ↗	Apr 3, 2024Wednesday, 3 April 2024, 12:15	8.8 HIGH	—
Lack of sanitization during Installation Process in Dolibarr ERP CRM up to version 19.0.0 allows an attacker with adjacent access to the network to execute arbitrary code via a specifically crafted input.