ShellCodeX
Tools • Events • News • Insights
 SEO Checker
ShellCodeX vulnerability brief
MEDIUM EPSS 0.2% Received

CVE-2026-71503

Dolibarr before 24.0.0 contains a reflected cross-site scripting vulnerability in the extra fields administration template where the type request parameter is echoed without JavaScript-context encoding into an inline script block and no Content-Security-Policy header is emitted. An unauthenticated attacker can cause an authenticated administrator to open a crafted URL to execute arbitrary JavaScript in that session and create a persistent administrator account.

Published 24 Aug 2026, 19:16 UTC Last modified 24 Aug 2026, 20:17 UTC
SCX

ShellCodeX risk assessment

Planned remediation priority based on exploitation evidence, CVSS conditions and affected-product data.

PriorityEvidenceDecision use
Planned EPSS estimates a 0.20% near-term exploitation probability. Validate against your asset inventory and vendor advisory.
Planned The vulnerable path is reachable over a network. Validate against your asset inventory and vendor advisory.
Planned Exploitation does not require prior privileges. Validate against your asset inventory and vendor advisory.
01

Attack profile

The conditions required to exploit this vulnerability and its potential impact.

Attack vector Network
Attack complexity Low
Privileges required None
User interaction Active
Scope Not assessed
Confidentiality Not assessed
Integrity Not assessed
Availability Not assessed
02

Affected products

Product applicability statements supplied with the NVD record.

NVD has not published structured affected-product data for this record.
03

Weakness classification

CWE categories help security teams group the underlying software weakness.

CWECWE-79
04

Source references

External advisories, patches and technical reports attached to this CVE record.

NVD National Vulnerability Database recordnvd.nist.gov 01 Technical reference disclosure@vulncheck.com 02 Technical reference disclosure@vulncheck.com 03 Technical reference disclosure@vulncheck.com 04 Technical reference disclosure@vulncheck.com