CVE-2021-33618: Dolibarr ERP/CRM stored XSS in object details

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

high priorityPublic exploit references and a very high EPSS score make exploitation likely, though the medium CVSS and required user interaction keep it below critical.

What it is

Dolibarr ERP and CRM 13.0.2 is vulnerable to cross-site scripting through object details, demonstrated by injecting > and < characters into the onpointermove attribute of a BODY element in the user-management feature. Because the payload is stored and rendered in a privileged administrative area, it can execute in the session of any user who views the affected record.

Impact

An attacker can run arbitrary script in the browser of a victim who views the crafted object, enabling session theft, credential capture or actions performed as that user. The CVSS scope change (S:C) indicates the impact can extend beyond the vulnerable component.

Attack surface

Reached over the network through the user-management feature where object details are stored and later rendered; the vector shows no privileges required (PR:N) but user interaction (UI:R) is needed for a victim to view the malicious content.

Exploitation

Not listed in CISA KEV, but EPSS is very high (0.79282, 99.58th percentile) and public references are tagged Exploit, indicating proof-of-concept code is publicly available. No ransomware association is documented.

What to do

• Upgrade Dolibarr to a release later than 13.0.2 that addresses this XSS; check the vendor release notes for the fixed version.
• Apply output encoding and input sanitization to object detail fields, especially HTML attributes such as onpointermove.
• Enforce a strict Content-Security-Policy to reduce script execution from injected markup.
• Restrict access to user-management and object-detail editing to trusted administrators only.

Detection

• Search web and application logs for requests containing onpointermove or other event-handler attributes in object detail or user-management parameters.
• Monitor for stored payloads containing angle brackets or event handlers in Dolibarr database fields rendered in admin views.
• Alert on anomalous authenticated sessions or actions following views of recently modified object records.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.