CVE-2019-15062

An issue was discovered in Dolibarr 11.0.0-alpha. A user can store an IFRAME element (containing a user/card.php CSRF request) in his Linked Files settings page. When visited by the admin, this could completely take over the admin account. (The protection mechanism for CSRF is to check the Referer header; however, because the attack is from one of the application's own settings pages, this mechanism is bypassed.)

• CWE-352

• https://gauravnarwani.com/publications/CVE-2019-15062/Exploit, Third Party Advisory
• https://github.com/Dolibarr/dolibarr/issues/11671Exploit, Issue Tracking, Patch, Third Party Advisory
• https://gauravnarwani.com/publications/CVE-2019-15062/Exploit, Third Party Advisory
• https://github.com/Dolibarr/dolibarr/issues/11671Exploit, Issue Tracking, Patch, Third Party Advisory

Published

Aug 14, 2019

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2019-15054Multiple cross-site scripting (XSS) vulnerabilities in Mailb…6.1
• CVE-2019-15055MikroTik RouterOS through 6.44.5 and 6.45.x through 6.45.3 i…
• CVE-2019-15058stb_image.h (aka the stb image loader) 2.23 has a heap-based…
• CVE-2019-15059In Liberty lisPBX 2.0-4, configuration backup files can be r…7.5
• CVE-2019-1506Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2019-15060The traceroute function on the TP-Link TL-WR840N v4 router w…
• CVE-2019-15064HiNet GPON firmware version < I040GWR190731 allows an attack…9.8
• CVE-2019-15065A service which is hosted on port 6998 in HiNet GPON firmwar…7.5
• CVE-2019-15066An “invalid command” handler issue was discovered in HiNet G…9.8
• CVE-2019-15067An authentication bypass vulnerability discovered in Smart B…9.8
• CVE-2019-15068A broken access control vulnerability in Smart Battery A4, a…9.8
• CVE-2019-15069An unsafe authentication interface was discovered in Smart B…9.8