Dolibarr versions 3.5 and 3.6 suffer from an html injection vulnerability.