diff --git a/htdocs/product/class/product.class.php b/htdocs/product/class/product.class.php
index 87a20aec899..5a4469aeab7 100644
--- a/htdocs/product/class/product.class.php
+++ b/htdocs/product/class/product.class.php
@@ -3187,14 +3187,16 @@ class Product extends CommonObject
 	/**
 	 *  Return an array formated for showing graphs
 	 *
-	 * @param  string $sql  Request to execute
-	 * @param  string $mode 'byunit'=number of unit, 'bynumber'=nb of entities
-	 * @param  int    $year Year (0=current year)
-	 * @return array               <0 if KO, result[month]=array(valuex,valuey) where month is 0 to 11
+	 * @param  string $sql  		Request to execute
+	 * @param  string $mode 		'byunit'=number of unit, 'bynumber'=nb of entities
+	 * @param  int    $year 		Year (0=current year, -1=all years)
+	 * @return array               	<0 if KO, result[month]=array(valuex,valuey) where month is 0 to 11
 	 */
 	private function _get_stats($sql, $mode, $year = 0)
 	{
 		// phpcs:enable
+        $tab = array();
+
 		$resql = $this->db->query($sql);
 		if ($resql) {
 			$num = $this->db->num_rows($resql);
@@ -3202,12 +3204,16 @@ class Product extends CommonObject
 			while ($i < $num)
 			{
 				$arr = $this->db->fetch_array($resql);
-				if ($mode == 'byunit') {
-					$tab[$arr[1]] = $arr[0]; // 1st field
-				}
-				if ($mode == 'bynumber') {
-					$tab[$arr[1]] = $arr[2]; // 3rd field
-				}
+                $keyfortab = (string) $arr[1];
+                if ($year == -1) {
+                	$keyfortab = substr($keyfortab, -2);
+                }
+
+                if ($mode == 'byunit') {
+                	$tab[$keyfortab] = (empty($tab[$keyfortab]) ? 0 : $tab[$keyfortab]) + $arr[0]; // 1st field
+                } elseif ($mode == 'bynumber') {
+                	$tab[$keyfortab] = (empty($tab[$keyfortab]) ? 0 : $tab[$keyfortab]) + $arr[2]; // 3rd field
+                }
 				$i++;
 			}
 		} else {
@@ -3215,21 +3221,26 @@ class Product extends CommonObject
 			return -1;
 		}
 
-		if (empty($year)) {
-			$year = strftime('%Y', time());
-			$month = strftime('%m', time());
-		} else {
-			$month = 12; // We imagine we are at end of year, so we get last 12 month before, so all correct year.
-		}
-		$result = array();
+        if (empty($year)) {
+            $year = strftime('%Y', time());
+            $month = strftime('%m', time());
+        } elseif ($year == -1) {
+        	$year = '';
+        	$month = 12; // We imagine we are at end of year, so we get last 12 month before, so all correct year.
+        } else {
+            $month = 12; // We imagine we are at end of year, so we get last 12 month before, so all correct year.
+        }
 
-		for ($j = 0; $j < 12; $j++)
-		{
-			//$idx = ucfirst(dol_trunc(dol_print_date(dol_mktime(12, 0, 0, $month, 1, $year), "%b"), 3, 'right', 'UTF-8', 1));
-			$idx = ucfirst(dol_trunc(dol_print_date(dol_mktime(12, 0, 0, $month, 1, $year), "%b"), 1, 'right', 'UTF-8', 1));
+        $result = array();
 
-			$result[$j] = array($idx, isset($tab[$year.$month]) ? $tab[$year.$month] : 0);
-			//            $result[$j] = array($monthnum,isset($tab[$year.$month])?$tab[$year.$month]:0);
+        for ($j = 0; $j < 12; $j++)
+        {
+			// $ids is 'D', 'N', 'O', 'S', ... (First letter of month in user language)
+        	$idx = ucfirst(dol_trunc(dol_print_date(dol_mktime(12, 0, 0, $month, 1, 1970), "%b"), 1, 'right', 'UTF-8', 1));
+
+			//print $idx.'-'.$year.'-'.$month.'<br>';
+            $result[$j] = array($idx, isset($tab[$year.$month]) ? $tab[$year.$month] : 0);
+            //            $result[$j] = array($monthnum,isset($tab[$year.$month])?$tab[$year.$month]:0);
 
 			$month = "0".($month - 1);
 			if (dol_strlen($month) == 3) {
@@ -3252,9 +3263,9 @@ class Product extends CommonObject
 	 * @param  int    $socid               Limit count on a particular third party id
 	 * @param  string $mode                'byunit'=number of unit, 'bynumber'=nb of entities
 	 * @param  int    $filteronproducttype 0=To filter on product only, 1=To filter on services only
-	 * @param  int    $year                Year (0=last 12 month)
+	 * @param  int    $year                Year (0=last 12 month, -1=all years)
 	 * @param  string $morefilter          More sql filters
-	 * @return array                            <0 if KO, result[month]=array(valuex,valuey) where month is 0 to 11
+	 * @return array                       <0 if KO, result[month]=array(valuex,valuey) where month is 0 to 11
 	 */
 	public function get_nb_vente($socid, $mode, $filteronproducttype = -1, $year = 0, $morefilter = '')
 	{
@@ -3305,9 +3316,9 @@ class Product extends CommonObject
 	 * @param  int    $socid               Limit count on a particular third party id
 	 * @param  string $mode                'byunit'=number of unit, 'bynumber'=nb of entities
 	 * @param  int    $filteronproducttype 0=To filter on product only, 1=To filter on services only
-	 * @param  int    $year                Year (0=last 12 month)
+	 * @param  int    $year                Year (0=last 12 month, -1=all years)
 	 * @param  string $morefilter          More sql filters
-	 * @return array                            <0 if KO, result[month]=array(valuex,valuey) where month is 0 to 11
+	 * @return array                       <0 if KO, result[month]=array(valuex,valuey) where month is 0 to 11
 	 */
 	public function get_nb_achat($socid, $mode, $filteronproducttype = -1, $year = 0, $morefilter = '')
 	{
@@ -3352,20 +3363,19 @@ class Product extends CommonObject
 
 	// phpcs:disable PEAR.NamingConventions.ValidFunctionName.ScopeNotCamelCaps
 	/**
-	 *  Return nb of units in proposals in which product is included
+	 * Return nb of units in proposals in which product is included
 	 *
 	 * @param  int    $socid               Limit count on a particular third party id
 	 * @param  string $mode                'byunit'=number of unit, 'bynumber'=nb of entities
 	 * @param  int    $filteronproducttype 0=To filter on product only, 1=To filter on services only
-	 * @param  int    $year                Year (0=last 12 month)
+	 * @param  int    $year                Year (0=last 12 month, -1=all years)
 	 * @param  string $morefilter          More sql filters
-	 * @return array                            <0 if KO, result[month]=array(valuex,valuey) where month is 0 to 11
+	 * @return array                       <0 if KO, result[month]=array(valuex,valuey) where month is 0 to 11
 	 */
 	public function get_nb_propal($socid, $mode, $filteronproducttype = -1, $year = 0, $morefilter = '')
 	{
 		// phpcs:enable
-		global $conf;
-		global $user;
+		global $conf, $user;
 
 		$sql = "SELECT sum(d.qty), date_format(p.datep, '%Y%m')";
 		if ($mode == 'bynumber') {
@@ -3409,9 +3419,9 @@ class Product extends CommonObject
 	 * @param  int    $socid               Limit count on a particular third party id
 	 * @param  string $mode                'byunit'=number of unit, 'bynumber'=nb of entities
 	 * @param  int    $filteronproducttype 0=To filter on product only, 1=To filter on services only
-	 * @param  int    $year                Year (0=last 12 month)
+	 * @param  int    $year                Year (0=last 12 month, -1=all years)
 	 * @param  string $morefilter          More sql filters
-	 * @return array                            <0 if KO, result[month]=array(valuex,valuey) where month is 0 to 11
+	 * @return array                       <0 if KO, result[month]=array(valuex,valuey) where month is 0 to 11
 	 */
 	public function get_nb_propalsupplier($socid, $mode, $filteronproducttype = -1, $year = 0, $morefilter = '')
 	{
@@ -3461,9 +3471,9 @@ class Product extends CommonObject
 	 * @param  int    $socid               Limit count on a particular third party id
 	 * @param  string $mode                'byunit'=number of unit, 'bynumber'=nb of entities
 	 * @param  int    $filteronproducttype 0=To filter on product only, 1=To filter on services only
-	 * @param  int    $year                Year (0=last 12 month)
+	 * @param  int    $year                Year (0=last 12 month, -1=all years)
 	 * @param  string $morefilter          More sql filters
-	 * @return array                            <0 if KO, result[month]=array(valuex,valuey) where month is 0 to 11
+	 * @return array                       <0 if KO, result[month]=array(valuex,valuey) where month is 0 to 11
 	 */
 	public function get_nb_order($socid, $mode, $filteronproducttype = -1, $year = 0, $morefilter = '')
 	{
@@ -3512,9 +3522,9 @@ class Product extends CommonObject
 	 * @param  int    $socid               Limit count on a particular third party id
 	 * @param  string $mode                'byunit'=number of unit, 'bynumber'=nb of entities
 	 * @param  int    $filteronproducttype 0=To filter on product only, 1=To filter on services only
-	 * @param  int    $year                Year (0=last 12 month)
+	 * @param  int    $year                Year (0=last 12 month, -1=all years)
 	 * @param  string $morefilter          More sql filters
-	 * @return array                            <0 if KO, result[month]=array(valuex,valuey) where month is 0 to 11
+	 * @return array                       <0 if KO, result[month]=array(valuex,valuey) where month is 0 to 11
 	 */
 	public function get_nb_ordersupplier($socid, $mode, $filteronproducttype = -1, $year = 0, $morefilter = '')
 	{
@@ -3563,9 +3573,9 @@ class Product extends CommonObject
 	 * @param  int    $socid               Limit count on a particular third party id
 	 * @param  string $mode                'byunit'=number of unit, 'bynumber'=nb of entities
 	 * @param  int    $filteronproducttype 0=To filter on product only, 1=To filter on services only
-	 * @param  int    $year                Year (0=last 12 month)
+	 * @param  int    $year                Year (0=last 12 month, -1=all years)
 	 * @param  string $morefilter          More sql filters
-	 * @return array                            <0 if KO, result[month]=array(valuex,valuey) where month is 0 to 11
+	 * @return array                       <0 if KO, result[month]=array(valuex,valuey) where month is 0 to 11
 	 */
 	public function get_nb_contract($socid, $mode, $filteronproducttype = -1, $year = 0, $morefilter = '')
 	{
@@ -3617,9 +3627,9 @@ class Product extends CommonObject
 	 * @param  int    $socid               Limit count on a particular third party id
 	 * @param  string $mode                'byunit'=number of unit, 'bynumber'=nb of entities
 	 * @param  int    $filteronproducttype 0=To filter on product only, 1=To filter on services only
-	 * @param  int    $year                Year (0=last 12 month)
+	 * @param  int    $year                Year (0=last 12 month, -1=all years)
 	 * @param  string $morefilter          More sql filters
-	 * @return array                            <0 if KO, result[month]=array(valuex,valuey) where month is 0 to 11
+	 * @return array                       <0 if KO, result[month]=array(valuex,valuey) where month is 0 to 11
 	 */
 	public function get_nb_mos($socid, $mode, $filteronproducttype = -1, $year = 0, $morefilter = '')
 	{
diff --git a/htdocs/product/stats/card.php b/htdocs/product/stats/card.php
index d4df28e0902..155ab81fae6 100644
--- a/htdocs/product/stats/card.php
+++ b/htdocs/product/stats/card.php
@@ -162,6 +162,7 @@ if (empty($id) && empty($ref)) {
 
 if ($result || empty($id)) {
     print '<form name="stats" method="POST" action="'.$_SERVER["PHP_SELF"].'">';
+    print '<input type="hidden" name="token" value="'.newToken().'">';
     print '<input type="hidden" name="id" value="'.$id.'">';
 
 	print '<table class="noborder centpercent">';
@@ -188,13 +189,14 @@ if ($result || empty($id)) {
 	// Year
 	print '<tr><td class="titlefield">'.$langs->trans("Year").'</td><td>';
 	$arrayyears = array();
-	for ($year = $currentyear - 10; $year < $currentyear + 10; $year++) {
-		$arrayyears[$year] = $year;
+	for ($year = $currentyear - 25; $year < $currentyear; $year++)
+	{
+	    $arrayyears[$year] = $year;
 	}
 	if (!in_array($year, $arrayyears)) $arrayyears[$year] = $year;
-	if (!in_array($nowyear, $arrayyears)) $arrayyears[$nowyear] = $nowyear;
+	if (!in_array($currentyear, $arrayyears)) $arrayyears[$currentyear] = $currentyear;
 	arsort($arrayyears);
-	print $form->selectarray('search_year', $arrayyears, $search_year, 0);
+	print $form->selectarray('search_year', $arrayyears, $search_year, 1);
 	print '</td></tr>';
 	print '</table>';
 	print '<div class="center"><input type="submit" name="submit" class="button" value="'.$langs->trans("Refresh").'"></div>';
@@ -240,49 +242,49 @@ if ($result || empty($id)) {
 
 	if ($conf->propal->enabled) {
 		$graphfiles['propal'] = array('modulepart'=>'productstats_proposals',
-		'file' => $object->id.'/propal12m'.((string) $type != '' ? '_type'.$type : '').'_'.$mode.($search_year ? '_year'.$search_year : '').'.png',
+		'file' => $object->id.'/propal12m'.((string) $type != '' ? '_type'.$type : '').'_'.$mode.($search_year > 0 ? '_year'.$search_year : '').'.png',
 		'label' => ($mode == 'byunit' ? $langs->transnoentitiesnoconv("NumberOfUnitsProposals") : $langs->transnoentitiesnoconv("NumberOfProposals")));
 	}
 
 	if ($conf->supplier_proposal->enabled) {
 		$graphfiles['proposalssuppliers'] = array('modulepart'=>'productstats_proposalssuppliers',
-		'file' => $object->id.'/proposalssuppliers12m'.((string) $type != '' ? '_type'.$type : '').'_'.$mode.($search_year ? '_year'.$search_year : '').'.png',
+		'file' => $object->id.'/proposalssuppliers12m'.((string) $type != '' ? '_type'.$type : '').'_'.$mode.($search_year > 0 ? '_year'.$search_year : '').'.png',
 		'label' => ($mode == 'byunit' ? $langs->transnoentitiesnoconv("NumberOfUnitsSupplierProposals") : $langs->transnoentitiesnoconv("NumberOfSupplierProposals")));
 	}
 
 	if ($conf->order->enabled) {
 		$graphfiles['orders'] = array('modulepart'=>'productstats_orders',
-		'file' => $object->id.'/orders12m'.((string) $type != '' ? '_type'.$type : '').'_'.$mode.($search_year ? '_year'.$search_year : '').'.png',
+		'file' => $object->id.'/orders12m'.((string) $type != '' ? '_type'.$type : '').'_'.$mode.($search_year > 0 ? '_year'.$search_year : '').'.png',
 		'label' => ($mode == 'byunit' ? $langs->transnoentitiesnoconv("NumberOfUnitsCustomerOrders") : $langs->transnoentitiesnoconv("NumberOfCustomerOrders")));
 	}
 
 	if ($conf->supplier_order->enabled) {
 		$graphfiles['orderssuppliers'] = array('modulepart'=>'productstats_orderssuppliers',
-		'file' => $object->id.'/orderssuppliers12m'.((string) $type != '' ? '_type'.$type : '').'_'.$mode.($search_year ? '_year'.$search_year : '').'.png',
+		'file' => $object->id.'/orderssuppliers12m'.((string) $type != '' ? '_type'.$type : '').'_'.$mode.($search_year > 0 ? '_year'.$search_year : '').'.png',
 		'label' => ($mode == 'byunit' ? $langs->transnoentitiesnoconv("NumberOfUnitsSupplierOrders") : $langs->transnoentitiesnoconv("NumberOfSupplierOrders")));
 	}
 
 	if ($conf->facture->enabled) {
 		$graphfiles['invoices'] = array('modulepart'=>'productstats_invoices',
-		'file' => $object->id.'/invoices12m'.((string) $type != '' ? '_type'.$type : '').'_'.$mode.($search_year ? '_year'.$search_year : '').'.png',
+		'file' => $object->id.'/invoices12m'.((string) $type != '' ? '_type'.$type : '').'_'.$mode.($search_year > 0 ? '_year'.$search_year : '').'.png',
 		'label' => ($mode == 'byunit' ? $langs->transnoentitiesnoconv("NumberOfUnitsCustomerInvoices") : $langs->transnoentitiesnoconv("NumberOfCustomerInvoices")));
 	}
 
 	if ($conf->supplier_invoice->enabled) {
 		$graphfiles['invoicessuppliers'] = array('modulepart'=>'productstats_invoicessuppliers',
-		'file' => $object->id.'/invoicessuppliers12m'.((string) $type != '' ? '_type'.$type : '').'_'.$mode.($search_year ? '_year'.$search_year : '').'.png',
+		'file' => $object->id.'/invoicessuppliers12m'.((string) $type != '' ? '_type'.$type : '').'_'.$mode.($search_year > 0 ? '_year'.$search_year : '').'.png',
 		'label' => ($mode == 'byunit' ? $langs->transnoentitiesnoconv("NumberOfUnitsSupplierInvoices") : $langs->transnoentitiesnoconv("NumberOfSupplierInvoices")));
 	}
 
 	if ($conf->contrat->enabled) {
 		$graphfiles['contracts'] = array('modulepart'=>'productstats_contracts',
-			'file' => $object->id.'/contracts12m'.((string) $type != '' ? '_type'.$type : '').'_'.$mode.($search_year ? '_year'.$search_year : '').'.png',
+			'file' => $object->id.'/contracts12m'.((string) $type != '' ? '_type'.$type : '').'_'.$mode.($search_year > 0 ? '_year'.$search_year : '').'.png',
 			'label' => ($mode == 'byunit' ? $langs->transnoentitiesnoconv("NumberOfUnitsContracts") : $langs->transnoentitiesnoconv("NumberOfContracts")));
 	}
 
 	if ($conf->mrp->enabled) {
 		$graphfiles['mrp'] = array('modulepart'=>'productstats_mrp',
-			'file' => $object->id.'/mos12m'.((string) $type != '' ? '_type'.$type : '').'_'.$mode.($search_year ? '_year'.$search_year : '').'.png',
+			'file' => $object->id.'/mos12m'.((string) $type != '' ? '_type'.$type : '').'_'.$mode.($search_year > 0 ? '_year'.$search_year : '').'.png',
 			'label' => ($mode == 'byunit' ? $langs->transnoentitiesnoconv("NumberOfUnitsMos") : $langs->transnoentitiesnoconv("NumberOfMos")));
 	}
 
diff --git a/htdocs/product/stats/commande.php b/htdocs/product/stats/commande.php
index 4e05d06e6f7..ec95c1d5638 100644
--- a/htdocs/product/stats/commande.php
+++ b/htdocs/product/stats/commande.php
@@ -59,7 +59,7 @@ $pageprev = $page - 1;
 $pagenext = $page + 1;
 if (!$sortorder) $sortorder = "DESC";
 if (!$sortfield) $sortfield = "c.date_commande";
-$search_month = GETPOST('search_month', 'alpha');
+$search_month = GETPOST('search_month', 'int');
 $search_year = GETPOST('search_year', 'int');
 
 if (GETPOST('button_removefilter_x', 'alpha') || GETPOST('button_removefilter', 'alpha')) {
diff --git a/htdocs/product/stats/commande_fournisseur.php b/htdocs/product/stats/commande_fournisseur.php
index aecb6a0240a..0c38ddf9d85 100644
--- a/htdocs/product/stats/commande_fournisseur.php
+++ b/htdocs/product/stats/commande_fournisseur.php
@@ -61,7 +61,7 @@ if (!$sortorder)
 	$sortorder = "DESC";
 if (!$sortfield)
 	$sortfield = "c.date_commande";
-$search_month = GETPOST('search_month', 'alpha');
+$search_month = GETPOST('search_month', 'int');
 $search_year = GETPOST('search_year', 'int');
 
 if (GETPOST('button_removefilter_x', 'alpha') || GETPOST('button_removefilter', 'alpha')) {
diff --git a/htdocs/product/stats/facture.php b/htdocs/product/stats/facture.php
index 2493aa83c20..1e166d120b7 100644
--- a/htdocs/product/stats/facture.php
+++ b/htdocs/product/stats/facture.php
@@ -61,7 +61,7 @@ $pagenext = $page + 1;
 if (!$sortorder) $sortorder = "DESC";
 if (!$sortfield) $sortfield = "f.datef";
 
-$search_month = GETPOST('search_month', 'alpha');
+$search_month = GETPOST('search_month', 'int');
 $search_year = GETPOST('search_year', 'int');
 
 if (GETPOST('button_removefilter_x', 'alpha') || GETPOST('button_removefilter', 'alpha')) {
diff --git a/htdocs/product/stats/facture_fournisseur.php b/htdocs/product/stats/facture_fournisseur.php
index a24794c9961..81e6429f57a 100644
--- a/htdocs/product/stats/facture_fournisseur.php
+++ b/htdocs/product/stats/facture_fournisseur.php
@@ -60,7 +60,7 @@ $pageprev = $page - 1;
 $pagenext = $page + 1;
 if (!$sortorder) $sortorder = "DESC";
 if (!$sortfield) $sortfield = "f.datef";
-$search_month = GETPOST('search_month', 'alpha');
+$search_month = GETPOST('search_month', 'int');
 $search_year = GETPOST('search_year', 'int');
 
 if (GETPOST('button_removefilter_x', 'alpha') || GETPOST('button_removefilter', 'alpha')) {
diff --git a/htdocs/product/stats/propal.php b/htdocs/product/stats/propal.php
index bf1108dee42..2c5da60a2cc 100644
--- a/htdocs/product/stats/propal.php
+++ b/htdocs/product/stats/propal.php
@@ -60,7 +60,7 @@ $pagenext = $page + 1;
 if (!$sortorder) $sortorder = "DESC";
 if (!$sortfield) $sortfield = "p.datep";
 
-$search_month = GETPOST('search_month', 'alpha');
+$search_month = GETPOST('search_month', 'int');
 $search_year = GETPOST('search_year', 'int');
 
 if (GETPOST('button_removefilter_x', 'alpha') || GETPOST('button_removefilter', 'alpha')) {
diff --git a/htdocs/product/stats/supplier_proposal.php b/htdocs/product/stats/supplier_proposal.php
index d718a8729ca..e13c0f5a5e9 100644
--- a/htdocs/product/stats/supplier_proposal.php
+++ b/htdocs/product/stats/supplier_proposal.php
@@ -60,7 +60,7 @@ $pagenext = $page + 1;
 if (!$sortorder) $sortorder = "DESC";
 if (!$sortfield) $sortfield = "p.date_valid";
 
-$search_month = GETPOST('search_month', 'alpha');
+$search_month = GETPOST('search_month', 'int');
 $search_year = GETPOST('search_year', 'int');
 
 if (GETPOST('button_removefilter_x', 'alpha') || GETPOST('button_removefilter', 'alpha')) {