CVE-2015-8685
MEDIUMDolibarr < 3.8.2 - XSS
Title source: ruleDescription
Multiple cross-site scripting (XSS) vulnerabilities in Dolibarr ERP/CRM 3.8.3 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) external calendar url or (2) the bank name field in the "import external calendar" page.
References (4)
Scores
CVSS v3
6.1
EPSS
0.0021
EPSS Percentile
43.5%
Attack Vector
NETWORK
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Classification
CWE
CWE-79
Status
draft
Affected Products (1)
dolibarr/dolibarr
< 3.8.2
Timeline
Published
Jan 15, 2016
Tracked Since
Feb 18, 2026