CVE-2021-47779

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

Dolibarr ERP-CRM 14.0.2 contains a stored cross-site scripting vulnerability in the ticket creation module that allows low-privilege users to inject malicious scripts. Attackers can craft a specially designed ticket message with embedded JavaScript that triggers when an administrator copies the text, potentially enabling privilege escalation.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

VendorProductVersions
DolibarrCRM14.0.2

References

Timeline

Published
Jan 16, 2026
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2021

CVE-2021-477807.8Macro Expert 4.7 contains an unquoted service path vulnerability that allows local users to potentially execute arbitrary code with elevatedCVE-2021-477819.8Cmder Console Emulator 1.3.18 contains a buffer overflow vulnerability that allows attackers to trigger a denial of service condition througCVE-2021-477828.2Odine Solutions GateKeeper 1.0 contains a SQL injection vulnerability in the trafficCycle API endpoint that allows remote attackers to injecCVE-2021-477835.4Phpwcms 1.9.30 contains a file upload vulnerability that allows authenticated attackers to upload malicious SVG files with embedded JavaScriCVE-2021-477847.5Cyberfox Web Browser 52.9.1 contains a denial of service vulnerability that allows attackers to crash the application by overflowing the seaCVE-2021-477859.8Ether MP3 CD Burner 1.3.8 contains a buffer overflow vulnerability in the registration name field that allows remote code execution. AttackeCVE-2021-477867.5Redragon Gaming Mouse driver contains a kernel-level vulnerability that allows attackers to trigger a denial of service by sending malformedCVE-2021-477877.8TotalAV 5.15.69 contains an unquoted service path vulnerability in multiple system services running with LocalSystem privileges. Attackers cCVE-2021-477888.8WebsiteBaker 2.13.0 contains an authenticated remote code execution vulnerability that allows users with language editing permissions to exeCVE-2021-477897.5Yenkee Hornet Gaming Mouse driver GM312Fltr.sys contains a buffer overrun vulnerability that allows attackers to crash the system by sendingCVE-2021-477907.8Active WebCam 11.5 contains an unquoted service path vulnerability that allows local attackers to execute arbitrary code with elevated systeCVE-2021-477917.5SmartFTP Client 10.0.2909.0 contains multiple denial of service vulnerabilities that allow attackers to crash the application through specif
CVE-2021-47779: Medium severity, CVSS 5.4 | Vulnix