CVE-2021-25955

CVE-2021-25955 is a stored Cross-Site Scripting (XSS) vulnerability affecting Dolibarr ERP CRM versions 2.8.1 through 13.0.2. A low-privileged user can inject malicious scripts into the "Private Note" field, which execute in a victim's browser upon viewing the page. This vulnerability has a CVSS score of 9.0 (CRITICAL) due to its network attack vector, low attack complexity, and high impact on confidentiality, integrity, and availability, potentially leading to administrator account takeover and privilege escalation. There is currently no evidence of active exploitation, publicly available exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion or media coverage.