Medium severity5.4OSV Advisory· Published Jan 16, 2026· Updated Jun 17, 2026

CVE-2021-47779

Description

Dolibarr ERP-CRM 14.0.2 contains a stored cross-site scripting vulnerability in the ticket creation module that allows low-privilege users to inject malicious scripts. Attackers can craft a specially designed ticket message with embedded JavaScript that triggers when an administrator copies the text, potentially enabling privilege escalation.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Dolibarr/DolibarrOSV3 versions
14.0.0, 14.0.1, 14.0.2, …+ 2 more
- (no CPE)range: 14.0.0, 14.0.1, 14.0.2, …
- cpe:2.3:a:dolibarr:dolibarr_erp\/crm:14.0.2:*:*:*:*:*:*:*
- (no CPE)range: = 14.0.2

Patches

Vulnerability mechanics

References

www.exploit-db.com/exploits/50432nvdExploitThird Party AdvisoryVDB Entry
www.vulncheck.com/advisories/dolibarr-erp-crm-stored-cross-site-scripting-xss-privilege-escalationnvdThird Party Advisory
www.dolibarr.orgnvdProduct

News mentions

No linked articles in our index yet.

cvss	0.351
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000