{"id":"CVE-2020-14475","aliases":["BIT-dolibarr-2020-14475","GHSA-m396-2x3h-v3v4"],"url":"https://o3.security/vulnerability/CVE-2020-14475","summary":"Dolibarr reflected cross-site scripting (XSS) vulnerability","details":"A reflected cross-site scripting (XSS) vulnerability in Dolibarr 11.0.3 allows remote attackers to inject arbitrary web script or HTML into public/notice.php (related to transphrase and transkey).","published":"2020-06-19T17:15:14.223Z","modified":"2026-08-07T15:11:41.288793Z","cvss":{"score":6.1,"severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"},"epss":{"score":0.0081,"percentile":0.5379,"asOf":"2026-08-23"},"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"Packagist","name":"dolibarr/dolibarr","fixedVersion":"11.0.5"}],"fix":{"url":"https://github.com/Dolibarr/dolibarr/commit/22ca5e067189bffe8066df26df923a386f044c08","label":"Dolibarr/dolibarr@22ca5e0"},"references":[{"type":"FIX","url":"https://github.com/Dolibarr/dolibarr/commit/22ca5e067189bffe8066df26df923a386f044c08"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-07T15:11:41.288793Z"}}