CVE-2023-38888
Critical · CVSS 9.6Dolibarr ERP CRM — Cross-Site Scripting (XSS) via REST API module
- CVSS
- 9.6
- nvd
- EPSS
- —
- KEV
- No
- Class
- oss containerizable
- CWE-79
Description
Cross Site Scripting vulnerability in Dolibarr ERP CRM v.17.0.1 and before allows a remote attacker to obtain sensitive information and execute arbitrary code via the REST API module, related to analyseVarsForSqlAndScriptsInjection and testSqlAndScriptInject.
Search profile — drives PoC discovery
Symbols analyseVarsForSqlAndScriptsInjectiontestSqlAndScriptInjectREST API moduledolibarr/dolibarr
Keywords CVE-2023-38888Dolibarr XSSDolibarr ERP CRM 17.0.1Dolibarr REST API XSSanalyseVarsForSqlAndScriptsInjectiontestSqlAndScriptInjectDolibarr cross site scriptingAKERVA Dolibarr
Versions: <= 17.0.1
Affected packages
| Bitnami | dolibarr | 0 → ∞ |
| Packagist | dolibarr/dolibarr | 0 → 17.0.1 |
References
Status: enriched · ingested 2026-07-05T06:00:39.000Z · profiled 2026-07-05T18:30:39.000Z