{"action":"Upgrade dolibarr/dolibarr to 3.5.8 or later.","affected":[{"fixed":"3.5.8","introduced":"3.5.0"}],"component":"dolibarr/dolibarr","cve_ids":["CVE-2015-3935"],"ecosystem":"Packagist","epss":0.01923,"exploited":false,"fixed_versions":["3.5.8"],"ghsa_id":"GHSA-6fw8-vf2x-4wpm","id":"tcs_01M5KEX0TD0XV2N0K356B2BCTV","modified_at":"2023-11-08T03:57:54.860538Z","published_at":"2022-05-17T03:29:57Z","references":["https://osv.dev/vulnerability/GHSA-6fw8-vf2x-4wpm","https://nvd.nist.gov/vuln/detail/CVE-2015-3935","https://github.com/Dolibarr/dolibarr/issues/2857","https://github.com/Dolibarr/dolibarr/issues/4291","https://github.com/Dolibarr/dolibarr/issues/4341","https://github.com/dolibarr/dolibarr/commit/a7f6bbd316e9b96216e9b2c7a065c9251c9a8907","https://web.archive.org/web/20210122162903/http://www.securityfocus.com/bid/74926","http://packetstormsecurity.com/files/132108/Dolibarr-3.5-3.6-HTML-Injection.html","http://seclists.org/fulldisclosure/2015/May/126"],"severity":{"label":"medium"},"sources":[{"source":"osv","source_id":"GHSA-6fw8-vf2x-4wpm","url":"https://osv.dev/vulnerability/GHSA-6fw8-vf2x-4wpm"}],"summary":"Dolibarr ERP and CRM contain Cross-site Scripting Vulnerability"}