CVE-2024-23817

Dolibarr is an enterprise resource planning (ERP) and customer relationship management (CRM) software package. Version 18.0.4 has a HTML Injection vulnerability in the Home page of the Dolibarr Application. This vulnerability allows an attacker to inject arbitrary HTML tags and manipulate the rendered content in the application's response. Specifically, I was able to successfully inject a new HTML tag into the returned document and, as a result, was able to comment out some part of the Dolibarr App Home page HTML code. This behavior can be exploited to perform various attacks like Cross-Site Scripting (XSS). To remediate the issue, validate and sanitize all user-supplied input, especially within HTML attributes, to prevent HTML injection attacks; and implement proper output encoding when rendering user-provided data to ensure it is treated as plain text rather than executable HTML.

• CWE-79
• CWE-80
• CWE-79

• https://github.com/Dolibarr/dolibarr/security/advisories/GHSA-7947-48q7-cp5mExploit, Vendor Advisory
• https://github.com/Dolibarr/dolibarr/security/advisories/GHSA-7947-48q7-cp5mExploit, Vendor Advisory

Published

Jan 25, 2024

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-23811A vulnerability has been identified in SINEC NMS (All versio…8.8
• CVE-2024-23812A vulnerability has been identified in SINEC NMS (All versio…8.8
• CVE-2024-23813A vulnerability has been identified in Polarion ALM (All ver…9.8
• CVE-2024-23814The integrated ICMP service of the network stack of affected…6.9
• CVE-2024-23815A vulnerability has been identified in Desigo CC (All versio…8.7
• CVE-2024-23816A vulnerability has been identified in Location Intelligence…9.8
• CVE-2024-23818GeoServer is an open source software server written in Java …4.8
• CVE-2024-23819GeoServer is an open source software server written in Java …4.8
• CVE-2024-2382The Authorize.net Payment Gateway For WooCommerce plugin for…5.3
• CVE-2024-23820OpenFGA, an authorization/permission engine, is vulnerable t…6.5
• CVE-2024-23821GeoServer is an open source software server written in Java …4.8
• CVE-2024-23822Thruk is a multibackend monitoring webinterface. Prior to 3…9.8