Skip to contentDolibarr Erp\/crm vulnerabilities
- dolibarr, dolibarr erp\/crm +1 moreDolibarr 9.0.0 through 23.0.4 Path Traversal via EmailCollector Attachment FilenameCVE-2026-817308.8 High
- dolibarr, dolibarr erp\/crm +1 moreDolibarr before 23.0.4 Incorrect Authorization on REST API Document DeletionCVE-2026-817297.1 High
- dolibarr, dolibarr erp\/crm +1 moreDolibarr before 24.0.0 SQL Injection via the CSV and XLSX Import Update KeysCVE-2026-817288.6 High
- dolibarr, dolibarr erp\/crm +1 moreDolibarr 21.0.0 < 24.0.0 Authorization Bypass via clonetasks Mass ActionCVE-2026-779235.3 Medium
- dolibarr erp crm, erp\/crm +1 moreDolibarr ERP CRM 7.0.3 Remote Code Execution via install/step1.phpCVE-2018-25357Fix available9.3 Critical
- dolibarr, dolibarr erp\/crm +1 moreDolibarr has an Authenticated Remote Code Execution via eval() injection in user extrafieldsCVE-2025-674868.6 High
- dolibarr erp\/crmDolibarr user with permission to edit PHP content can bypass filtering to restrict dangerous PHP functionsCVE-2026-310198.8 High
- dolibarr erp\/crmDolibarr Allows Code Injection through its Website ModuleCVE-2026-310188.8 High
- dolibarr, dolibarr erp\/crm +1 moreDolibarr: OS Command Injection (RCE) via MAIN_ODT_AS_PDF configurationCVE-2026-23500Public exploit9.4 Critical
- dolibarr erp-crm, erp\/crm +1 moreDolibarr ERP-CRM 8.0.4 SQL Injection via rowid ParameterCVE-2019-257108.8 High
- dolibarr erp/crm, erp\/crm +1 moreDolibarr ERP/CRM < 23.0.2 Authenticated RCE via dol_eval_standard()CVE-2026-22666Public exploitEPSS 15.8%8.6 High
- dolibarr, dolibarr erp\/crm +1 moreDolibarr Core Discloses Sensitive Data via Authenticated Local File Inclusion in selectobject.phpCVE-2026-34036Public exploitFix available6.5 Medium
- dolibarr erp/crm, erp\/crm +1 moreDolibarr ERP/CRM 10.0.1 SQL Injection via elemidCVE-2019-254528.8 High
- dolibarr erp/crm, erp\/crm +1 moreDolibarr ERP/CRM 10.0.1 SQL Injection via card.phpCVE-2019-254507.1 High
- churchcrm crm, dolibarr erp\/crm +1 moreDolibarr ERP-CRM 14.0.2 - Stored Cross-Site Scripting (XSS) / Privilege EscalationCVE-2021-477798.4 High
- dolibarr erp\/crmDolibarr vulnerable to RCE via the computed field parameterCVE-2025-56588Fix available8.8 High
- dolibarr erp\/crmDolibarr Cross-site Scripting vulnerabilityCVE-2024-55228Fix available9.0 Critical
- dolibarr erp\/crmDolibarr Cross-site Scripting vulnerabilityCVE-2024-55227Fix available9.0 Critical
- dolibarr, dolibarr dolibarr/dolibarr, erp\/crm +2 moreImproper Authorization in dolibarr/dolibarrCVE-2021-3991Fix available4.3 Medium
- dolibarr erp\/crmDolibarr ERP CRM vulnerable to remote code execution (RCE)CVE-2024-40137Fix available5.5 Medium
- dolibarr erp\/crmDolibarr arbitrary file upload vulnerabilityCVE-2024-37821Fix available8.8 High
- dolibarr, dolibarr erp cms, erp\/crm +2 moreMultiple vulnerabilities in DOLIBARR's ERP CMSCVE-2024-5315Fix availableEPSS 34.5%9.1 Critical
- dolibarr erp cms, erp\/crm +1 moreMultiple vulnerabilities in DOLIBARR's ERP CMSCVE-2024-5314Fix available9.1 Critical
- dolibarr erp\/crmDolibarr vulnerable to Cross-Site Request ForgeryCVE-2024-31503Fix available7.5 High
- dolibarr erp\/crmDolibarr ERP CRM Code Injection vulnerability during installationCVE-2024-29477Fix available8.8 High
- dolibarr, dolibarr erp\/crm +1 moreDolibarr Application Home Page HTML injection vulnerabilityCVE-2024-23817Fix available7.1 High
- dolibarr erp crm, erp\/crm +1 moreDolibarr ERP CRM (<= 17.0.3) Improper Access ControlCVE-2023-4198Fix available6.5 Medium
- dolibarr erp crm, erp\/crm +1 moreDolibarr ERP CRM (<= 18.0.1) Improper Input Sanitization Authenticated RCECVE-2023-4197Public exploitFix availableEPSS 36.2%7.5 High
- dolibarr, dolibarr dolibarr/dolibarr, erp\/crm +2 moreCross-site Scripting (XSS) - Stored in dolibarr/dolibarrCVE-2023-5842Fix available4.8 Medium
- dolibarr, dolibarr dolibarr/dolibarr, erp\/crm +2 moreCross-site Scripting (XSS) - Generic in dolibarr/dolibarrCVE-2023-5323Fix available5.4 Medium
- dolibarr erp\/crmCross Site Scripting vulnerability in Dolibarr ERP CRMCVE-2023-38888Fix available9.6 Critical
- dolibarr erp\/crmFile Upload vulnerability in Dolibarr ERP CRMCVE-2023-38887Fix available8.8 High
- dolibarr erp\/crmDolibarr allows a remote privileged attacker to execute arbitrary code via a crafted command/scriptCVE-2023-38886Fix availableEPSS 29.6%7.2 High
- dolibarr erp\/crmDolibarr vulnerable to unauthenticated database accessCVE-2023-33568Fix availableEPSS 14.9%7.5 High
- dolibarr erp\/crmDolibarr vulnerable to remote code execution via uppercase manipulationCVE-2023-30253Public exploitFix availableEPSS 82.1%8.8 High
- dolibarr dolibarr/dolibarr, erp\/crm +1 moreSQL Injection in dolibarr/dolibarrCVE-2022-4093Fix available8.1 High
- dolibarr erp\/crmDolibarr vulnerable to privilege escalationCVE-2022-43138Fix available9.8 Critical
- dolibarr erp\/crmDolibarr vulnerable to Eval InjectionCVE-2022-40871EPSS 34.6%9.8 Critical
- dolibarr dolibarr/dolibarr, erp\/crm +1 moreCross-site Scripting (XSS) - Stored in dolibarr/dolibarrCVE-2022-2060Fix available8.4 High
- dolibarr erp\/crmCross-site Scripting in DolibarrCVE-2022-308756.1 Medium
- dolibarr erp\/crmAccess Control vulnerability in DolibarrCVE-2021-37517Fix available7.5 High
- dolibarr erp\/crmSQL Injection in DolibarrCVE-2021-36625Fix available8.8 High
- dolibarr dolibarr/dolibarr, erp\/crm +1 moreCode Injection in dolibarr/dolibarrCVE-2022-0819Fix availableEPSS 42.7%7.2 High
- dolibarr dolibarr/dolibarr, erp\/crm +1 moreBusiness Logic Errors in dolibarr/dolibarrCVE-2022-0746Fix available4.3 Medium
- dolibarr dolibarr/dolibarr, erp\/crm +1 moreImproper Access Control (IDOR) in dolibarr/dolibarrCVE-2022-0731Fix available5.4 Medium
- dolibarr dolibarr/dolibarr, erp\/crm +1 moreImproper Validation of Specified Quantity in Input in dolibarr/dolibarrCVE-2022-0414Fix available4.1 Medium
- dolibarr dolibarr/dolibarr, erp\/crm +1 moreSQL Injection in dolibarr/dolibarrCVE-2022-0224Fix available8.3 High
- dolibarr dolibarr/dolibarr, erp\/crm +1 moreImproper Validation of Specified Quantity in Input in dolibarr/dolibarrCVE-2022-0174Fix available4.3 Medium
- dolibarr erp\/crmCross site scripting in dolibarrCVE-2022-22293Fix available5.4 Medium
- dolibarr erp\/crmDolibarr ERP and CRM contain XSS VulnerabilityCVE-2021-33618EPSS 79.3%6.1 Medium
- Show moreLoading…