{"id":"GHSA-6fw8-vf2x-4wpm","aliases":["CVE-2015-3935"],"title":"Dolibarr ERP and CRM contain Cross-site Scripting Vulnerability","titleSource":"OSV","descriptionSource":"OSV","declaredSeverity":"MODERATE","description":"Multiple cross-site scripting (XSS) vulnerabilities in Dolibarr ERP/CRM 3.5 and 3.6 allow remote attackers to inject arbitrary web script or HTML via the Business Search (`search_nom`) field to (1) `htdocs/societe/societe.php` or (2) `htdocs/societe/admin/societe.php`.","severity":"medium","score":null,"published":"2022-05-17T03:29:57.000Z","modified":"2023-11-08T03:57:54.860Z","withdrawn":false,"knownExploited":false,"affected":[{"ecosystem":"Packagist","name":"dolibarr/dolibarr","sources":[{"name":"OSV · GHSA-6fw8-vf2x-4wpm","url":"https://osv.dev/vulnerability/GHSA-6fw8-vf2x-4wpm"}],"ranges":[{"events":[{"introduced":"3.5.0"},{"fixed":"3.5.8"}],"type":"ECOSYSTEM"}],"versions":[],"fixed":["3.5.8"]}],"sourceAffected":[],"references":["https://nvd.nist.gov/vuln/detail/CVE-2015-3935","https://github.com/Dolibarr/dolibarr/issues/2857","https://github.com/Dolibarr/dolibarr/issues/4291","https://github.com/Dolibarr/dolibarr/issues/4341","https://github.com/dolibarr/dolibarr/commit/a7f6bbd316e9b96216e9b2c7a065c9251c9a8907","https://web.archive.org/web/20210122162903/http://www.securityfocus.com/bid/74926","http://packetstormsecurity.com/files/132108/Dolibarr-3.5-3.6-HTML-Injection.html","http://seclists.org/fulldisclosure/2015/May/126"],"sources":[{"name":"OSV","id":"GHSA-6fw8-vf2x-4wpm","modified":"2023-11-08T03:57:54.860538Z","url":"https://osv.dev/vulnerability/GHSA-6fw8-vf2x-4wpm"}],"assessments":[],"products":[],"remediation":[],"kev":{"status":"not-listed","checkedAt":"2026-10-29T02:25:31.980Z"},"coverage":[{"source":"NVD","status":"not-checked"},{"source":"GHSA","status":"not-checked"},{"source":"EUVD","status":"not-checked"},{"source":"EPSS","status":"not-checked"}],"evidence":[]}