CVE-2020-11825

In Dolibarr 10.0.6, forms are protected with a CSRF token against CSRF attacks. The problem is any CSRF token in any user's session can be used in another user's session. CSRF tokens should not be valid in this situation.

• CWE-352

• https://fatihhcelik.blogspot.com/2020/04/dolibarr-csrf.htmlExploit, Third Party Advisory
• https://fatihhcelik.blogspot.com/2020/04/dolibarr-csrf.htmlExploit, Third Party Advisory

Published

Apr 16, 2020

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-11819In Rukovoditel 2.5.2, an attacker may inject an arbitrary .p…9.8
• CVE-2020-1182A remote code execution vulnerability exists in Microsoft Dy…7.3
• CVE-2020-11820Rukovoditel 2.5.2 is affected by a SQL injection vulnerabili…9.8
• CVE-2020-11821In Rukovoditel 2.5.2, users' passwords and usernames are sto…5.3
• CVE-2020-11822In Rukovoditel 2.5.2, there is a stored XSS vulnerability on…6.1
• CVE-2020-11823In Dolibarr 10.0.6, if USER_LOGIN_FAILED is active, there is…5.4
• CVE-2020-11826Users can lock their notes with a password in Memono version…7.5
• CVE-2020-11827In GOG Galaxy 1.2.67, there is a service that is vulnerable …7.8
• CVE-2020-11828In ColorOS (oppo mobile phone operating system, based on AOS…7.5
• CVE-2020-11829Dynamic loading of services in the backup and restore SDK le…9.8
• CVE-2020-1183A cross-site-scripting (XSS) vulnerability exists when Micro…5.4
• CVE-2020-11830QualityProtect has a vulnerability to execute arbitrary syst…9.8