Dolibarr vulnerabilities

Products

• Erp\/crm 112
• Dolibarr 73
• Dolibarr/dolibarr 11
• Erp Crm 5
• Erp/crm 4
• Erp Crm 3
• Erp 2
• Erp Cms 2

Newest

• dolibarr erp/crm Dolibarr ERP CRM before 24.0.2 Missing Authorization via public recruitment view.php CVE-2026-118754 6.9 MediumOctober 28, 2026
• dolibarr Dolibarr: SQL Injection in societe/class/societe.class.php via localtax1_value parameter CVE-2026-33944 Fix available 8.8 HighOctober 27, 2026
• dolibarr Dolibarr ERP CRM before 24.0.0 OS Command Injection via mysqldump Parameter CVE-2026-116219 8.6 HighOctober 26, 2026
• dolibarr Dolibarr ERP CRM 19.0.0 before 23.0.4 SQL Injection via bankaccounts API type field CVE-2026-116218 7.2 HighOctober 26, 2026
• dolibarr Dolibarr CSP document.php protection mechanism CVE-2026-112361 5.3 MediumOctober 19, 2026
• dolibarr Dolibarr before 23.0.4 PHP Object Injection via jsonOrUnserialize() CVE-2026-110874 7.5 HighOctober 15, 2026
• dolibarr Dolibarr before 24.0.2 Incorrect Authorization via updateextrafield.php CVE-2026-107706 5.3 MediumOctober 8, 2026
• dolibarr Dolibarr 23.0.4 < 24.0.1 Authorization Bypass via hashp Parameter in document.php CVE-2026-89013 Public exploit 8.7 HighSeptember 11, 2026
• dolibarr Dolibarr 24.0.0 < 24.0.1 SQL Filter Denylist Bypass via sqlfilters Parameter CVE-2026-89012 Public exploit 7.1 HighSeptember 11, 2026
• dolibarr Dolibarr Legacy File Manager config.inc.php access control CVE-2026-85401 5.3 MediumSeptember 4, 2026
• dolibarr Dolibarr 10.0.0 before 24.0.0 Missing Authorization on REST Users Groups Endpoint CVE-2026-82633 5.3 MediumAugust 30, 2026
• dolibarr, dolibarr erp\/crm +1 more Dolibarr 9.0.0 through 23.0.4 Path Traversal via EmailCollector Attachment Filename CVE-2026-81730 8.8 HighAugust 27, 2026
• dolibarr, dolibarr erp\/crm +1 more Dolibarr before 23.0.4 Incorrect Authorization on REST API Document Deletion CVE-2026-81729 7.1 HighAugust 27, 2026
• dolibarr, dolibarr erp\/crm +1 more Dolibarr before 24.0.0 SQL Injection via the CSV and XLSX Import Update Keys CVE-2026-81728 8.6 HighAugust 27, 2026
• dolibarr, dolibarr erp\/crm +1 more Dolibarr 21.0.0 < 24.0.0 Authorization Bypass via clonetasks Mass Action CVE-2026-77923 5.3 MediumAugust 24, 2026
• dolibarr Dolibarr < 24.0.0 Members REST API Sensitive Data Exposure via Member Endpoints CVE-2026-71511 7.1 HighAugust 24, 2026
• dolibarr Dolibarr < 24.0.0 Users REST API SQL Injection via filter parameter CVE-2026-71510 7.1 HighAugust 24, 2026
• dolibarr Dolibarr < 24.0.0 Expense Report REST API Improper Authorization via Update Endpoint CVE-2026-71509 7.1 HighAugust 24, 2026
• dolibarr Dolibarr < 24.0.0 REST API Improper Authorization via User Update Endpoint CVE-2026-71508 7.1 HighAugust 24, 2026
• dolibarr Dolibarr < 24.0.0 REST API Broken Object-Level Authorization via Bank Account Routes CVE-2026-71507 7.1 HighAugust 24, 2026
• dolibarr Dolibarr < 24.0.0 Payments REST API Improper Authorization via Delete Endpoint CVE-2026-71506 7.2 HighAugust 24, 2026
• dolibarr Dolibarr < 24.0.0 REST API Broken Object-Level Authorization via Third-Party Write Route CVE-2026-71505 7.1 HighAugust 24, 2026
• dolibarr Dolibarr < 24.0.0 Members REST API Improper Authorization via Password Reset CVE-2026-71504 8.6 HighAugust 24, 2026
• dolibarr Dolibarr < 24.0.0 Reflected XSS via Extra Fields Administration Template CVE-2026-71503 5.1 MediumAugust 24, 2026
• aureus erp Dolibarr ERP User Notes note.php authorization CVE-2026-78160 5.3 MediumAugust 24, 2026
• dolibarr Dolibarr Account card.php improper authorization CVE-2026-77686 5.3 MediumAugust 21, 2026
• dolibarr Dolibarr User Cloning card.php ldap injection CVE-2026-19930 5.3 MediumAugust 16, 2026
• aureus erp Dolibarr ERP TakePOS invoice.php fail authorization CVE-2026-19350 5.3 MediumAugust 9, 2026
• dolibarr Dolibarr - SQL Injection via sqlfilters Parameter in Multiple REST API List Endpoints CVE-2026-58376 7.2 HighJune 30, 2026
• dolibarr erp crm Dolibarr ERP CRM Legacy Filemanager config.inc.php improper authorization CVE-2026-11619 5.3 MediumJune 9, 2026
• dolibarr erp crm Dolibarr ERP CRM Leave Request REST API api_holidays.class.php checkUserAccessToObject improper authorization CVE-2026-10215 5.3 MediumJune 1, 2026
• dolibarr erp crm Dolibarr ERP CRM messaging.php authorization CVE-2026-10154 5.3 MediumMay 30, 2026
• dolibarr erp crm, erp\/crm +1 more Dolibarr ERP CRM 7.0.3 Remote Code Execution via install/step1.php CVE-2018-25357 Fix available 9.3 CriticalMay 23, 2026
• dolibarr, dolibarr erp\/crm +1 more Dolibarr has an Authenticated Remote Code Execution via eval() injection in user extrafields CVE-2025-67486 8.6 HighMay 8, 2026
• dolibarr erp crm Dolibarr ERP CRM Online Signature security.lib.php dol_verifyHash signature verification CVE-2026-7689 6.3 MediumMay 3, 2026
• dolibarr erp crm Dolibarr ERP CRM Shipments API Endpoint expedition.class.php _checkValForAPI sql injection CVE-2026-7688 2.3 LowMay 3, 2026
• dolibarr erp\/crm Dolibarr user with permission to edit PHP content can bypass filtering to restrict dangerous PHP functions CVE-2026-31019 8.8 HighApril 21, 2026
• dolibarr erp\/crm Dolibarr Allows Code Injection through its Website Module CVE-2026-31018 8.8 HighApril 21, 2026
• dolibarr, dolibarr erp\/crm +1 more Dolibarr: OS Command Injection (RCE) via MAIN_ODT_AS_PDF configuration CVE-2026-23500 Public exploit 9.4 CriticalApril 17, 2026
• dolibarr erp-crm, erp\/crm +1 more Dolibarr ERP-CRM 8.0.4 SQL Injection via rowid Parameter CVE-2019-25710 8.8 HighApril 12, 2026
• dolibarr erp/crm, erp\/crm +1 more Dolibarr ERP/CRM < 23.0.2 Authenticated RCE via dol_eval_standard() CVE-2026-22666 Public exploit EPSS 15.8% 8.6 HighApril 7, 2026
• dolibarr, dolibarr erp\/crm +1 more Dolibarr Core Discloses Sensitive Data via Authenticated Local File Inclusion in selectobject.php CVE-2026-34036 Public exploitFix available 6.5 MediumMarch 27, 2026
• dolibarr erp/crm, erp\/crm +1 more Dolibarr ERP/CRM 10.0.1 SQL Injection via elemid CVE-2019-25452 8.8 HighFebruary 22, 2026
• dolibarr erp/crm, erp\/crm +1 more Dolibarr ERP/CRM 10.0.1 SQL Injection via card.php CVE-2019-25450 7.1 HighFebruary 22, 2026
• dolibarr Dolibarr 11.0.3 - 'ldap.php' - Persistent Cross-Site Scripting CVE-2020-36966 5.1 MediumJanuary 30, 2026
• churchcrm crm, dolibarr erp\/crm +1 more Dolibarr ERP-CRM 14.0.2 - Stored Cross-Site Scripting (XSS) / Privilege Escalation CVE-2021-47779 8.4 HighJanuary 15, 2026
• dolibarr erp\/crm Dolibarr vulnerable to RCE via the computed field parameter CVE-2025-56588 Fix available 8.8 HighOctober 1, 2025
• dolibarr erp\/crm Dolibarr Cross-site Scripting vulnerability CVE-2024-55228 Fix available 9.0 CriticalJanuary 27, 2025
• dolibarr erp\/crm Dolibarr Cross-site Scripting vulnerability CVE-2024-55227 Fix available 9.0 CriticalJanuary 27, 2025
• dolibarr, dolibarr dolibarr/dolibarr, erp\/crm +2 more Improper Authorization in dolibarr/dolibarr CVE-2021-3991 Fix available 4.3 MediumNovember 15, 2024
• Show olderLoading…