CVE-2020-9016: 
PHP vulnerability analysis and mitigation

Dolibarr 11.0, an ERP/CRM software, was found to contain a Cross-Site Scripting (XSS) vulnerability identified as CVE-2020-9016. The vulnerability was discovered and disclosed on February 16, 2020. The issue allows attackers to execute XSS attacks through multiple entry points including the joinfiles, topic, code parameters, and the HTTP Referer header (NVD, CVE).

The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation). According to the CVSS 3.1 scoring system, it received a base score of 5.4 (Medium severity) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N. Under CVSS 2.0, it scored 3.5 (Low severity) with the vector (AV:N/AC:M/Au:S/C:N/I:P/A:N). The vulnerability requires user interaction and affects the confidentiality and integrity of the system (NVD).

The vulnerability allows attackers to inject malicious scripts through various parameters, potentially leading to the execution of unauthorized code in users' browsers. This could result in theft of sensitive information, session hijacking, or other client-side attacks. The impact is considered moderate as it requires user interaction and has limited potential for data exposure (NVD).