{"id":"CVE-2020-14475","details":"A reflected cross-site scripting (XSS) vulnerability in Dolibarr 11.0.3 allows remote attackers to inject arbitrary web script or HTML into public/notice.php (related to transphrase and transkey).","aliases":["BIT-dolibarr-2020-14475","GHSA-m396-2x3h-v3v4"],"modified":"2026-08-07T15:11:41.288793Z","published":"2020-06-19T17:15:14.223Z","references":[{"type":"FIX","url":"https://github.com/Dolibarr/dolibarr/commit/22ca5e067189bffe8066df26df923a386f044c08"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/dolibarr/dolibarr","events":[{"introduced":"a413e2861e4f3bef054eb09fd8fdc4c55c6a4709"},{"last_affected":"a413e2861e4f3bef054eb09fd8fdc4c55c6a4709"},{"fixed":"22ca5e067189bffe8066df26df923a386f044c08"}],"database_specific":{"cpe":"cpe:2.3:a:dolibarr:dolibarr_erp\\/crm:11.0.3:*:*:*:*:*:*:*","extracted_events":[{"introduced":"11.0.3"},{"last_affected":"11.0.3"}],"source":["CPE_STRING","REFERENCES"]}}],"versions":["11.0.3","11.0.4"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2020-14475.json"}}],"schema_version":"1.8.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"}]}