VYPR
← All advisories
Medium severity5.4NVD Advisory· Published Jul 29, 2019· Updated Jun 17, 2026

CVE-2019-11199

CVE-2019-11199

Description

Dolibarr ERP/CRM 9.0.1 was affected by stored XSS within uploaded files. These vulnerabilities allowed the execution of a JavaScript payload each time any regular user or administrative user clicked on the malicious link hosted on the same domain. The vulnerabilities could be exploited by low privileged users to target administrators. The viewimage.php page did not perform any contextual output encoding and would display the content within the uploaded file with a user-requested MIME type.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

3
  • Dolibarr/Dolibarr2 versions
    cpe:2.3:a:dolibarr:dolibarr_erp\/crm:9.0.1:*:*:*:*:*:*:*+ 1 more
    • cpe:2.3:a:dolibarr:dolibarr_erp\/crm:9.0.1:*:*:*:*:*:*:*
    • (no CPE)range: = 9.0.1
  • Dolibarr/ERP/CRMdescription

Patches

Vulnerability mechanics

References

1

News mentions

0

No linked articles in our index yet.