CVE-2017-17971: Dolibarr Erp/crm

Medium severity, CVSS 6.1. EPSS: 1% chance of exploitation in the next 30 days.

The test_sql_and_script_inject function in htdocs/main.inc.php in Dolibarr ERP/CRM 6.0.4 blocks some event attributes but neither onclick nor onscroll, which allows XSS.

Affected products

• Dolibarr Dolibarr Erp/crm: version 6.0.4 only

Published 2017-12-29. Last modified 2026-06-17.