CVE-2015-3935: Multiple cross-site scripting (XSS) vulnerabilities in Dolibarr ERP/CRM 3.5 and 3.6 allow remote attackers...

Security readout for executives and security teams

Dolibarr ERP/CRM 3.5 and 3.6 contain cross-site scripting flaws in Business Search. An attacker could cause script or HTML to run in a user's browser when the vulnerable search field is handled by company-related pages. Business impact depends on who uses the affected pages and whether Dolibarr is exposed to untrusted users. Exposure is most likely in organizations still running Dolibarr ERP/CRM 3.5 or 3.6, especially where company search pages are reachable by untrusted or low-privileged users. The bundled metadata does not identify other affected products or versions. Prioritize remediation for internet-facing or multi-user Dolibarr systems because XSS can support session theft, unauthorized actions, or misleading business records. For isolated legacy systems, handle through the normal vulnerability backlog, but avoid leaving unsupported ERP software untracked. Mitigation focus: Inventory Dolibarr deployments and identify any 3.5 or 3.6 instances.; Review Dolibarr issue 2857 and the linked commit for vendor remediation context.; Upgrade to a supported fixed Dolibarr release if vendor guidance confirms coverage..

Prepared

Jun 13, 2026, 22:39 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.