CVE-2021-47779: Dolibarr Erp/crm

Medium severity, CVSS 5.4. EPSS: 0.4% chance of exploitation in the next 30 days.

Dolibarr ERP-CRM 14.0.2 contains a stored cross-site scripting vulnerability in the ticket creation module that allows low-privilege users to inject malicious scripts. Attackers can craft a specially designed ticket message with embedded JavaScript that triggers when an administrator copies the text, potentially enabling privilege escalation.

Affected products

• Dolibarr Dolibarr Erp/crm: version 14.0.2 only

Published 2026-01-16. Last modified 2026-06-17.