Dolibarr Erp vulnerabilities

• dolibarr erp/crm Dolibarr ERP CRM before 24.0.2 Missing Authorization via public recruitment view.php CVE-2026-118754 6.9 MediumOctober 28, 2026
• dolibarr, dolibarr erp\/crm +1 more Dolibarr 9.0.0 through 23.0.4 Path Traversal via EmailCollector Attachment Filename CVE-2026-81730 8.8 HighAugust 27, 2026
• dolibarr, dolibarr erp\/crm +1 more Dolibarr before 23.0.4 Incorrect Authorization on REST API Document Deletion CVE-2026-81729 7.1 HighAugust 27, 2026
• dolibarr, dolibarr erp\/crm +1 more Dolibarr before 24.0.0 SQL Injection via the CSV and XLSX Import Update Keys CVE-2026-81728 8.6 HighAugust 27, 2026
• dolibarr, dolibarr erp\/crm +1 more Dolibarr 21.0.0 < 24.0.0 Authorization Bypass via clonetasks Mass Action CVE-2026-77923 5.3 MediumAugust 24, 2026
• aureus erp Dolibarr ERP User Notes note.php authorization CVE-2026-78160 5.3 MediumAugust 24, 2026
• aureus erp Dolibarr ERP TakePOS invoice.php fail authorization CVE-2026-19350 5.3 MediumAugust 9, 2026
• dolibarr erp crm Dolibarr ERP CRM Legacy Filemanager config.inc.php improper authorization CVE-2026-11619 5.3 MediumJune 9, 2026
• dolibarr erp crm Dolibarr ERP CRM Leave Request REST API api_holidays.class.php checkUserAccessToObject improper authorization CVE-2026-10215 5.3 MediumJune 1, 2026
• dolibarr erp crm Dolibarr ERP CRM messaging.php authorization CVE-2026-10154 5.3 MediumMay 30, 2026
• dolibarr erp crm, erp\/crm +1 more Dolibarr ERP CRM 7.0.3 Remote Code Execution via install/step1.php CVE-2018-25357 Fix available 9.3 CriticalMay 23, 2026
• dolibarr, dolibarr erp\/crm +1 more Dolibarr has an Authenticated Remote Code Execution via eval() injection in user extrafields CVE-2025-67486 8.6 HighMay 8, 2026
• dolibarr erp crm Dolibarr ERP CRM Online Signature security.lib.php dol_verifyHash signature verification CVE-2026-7689 6.3 MediumMay 3, 2026
• dolibarr erp crm Dolibarr ERP CRM Shipments API Endpoint expedition.class.php _checkValForAPI sql injection CVE-2026-7688 2.3 LowMay 3, 2026
• dolibarr erp\/crm Dolibarr user with permission to edit PHP content can bypass filtering to restrict dangerous PHP functions CVE-2026-31019 8.8 HighApril 21, 2026
• dolibarr erp\/crm Dolibarr Allows Code Injection through its Website Module CVE-2026-31018 8.8 HighApril 21, 2026
• dolibarr, dolibarr erp\/crm +1 more Dolibarr: OS Command Injection (RCE) via MAIN_ODT_AS_PDF configuration CVE-2026-23500 Public exploit 9.4 CriticalApril 17, 2026
• dolibarr erp-crm, erp\/crm +1 more Dolibarr ERP-CRM 8.0.4 SQL Injection via rowid Parameter CVE-2019-25710 8.8 HighApril 12, 2026
• dolibarr erp/crm, erp\/crm +1 more Dolibarr ERP/CRM < 23.0.2 Authenticated RCE via dol_eval_standard() CVE-2026-22666 Public exploit EPSS 15.8% 8.6 HighApril 7, 2026
• dolibarr, dolibarr erp\/crm +1 more Dolibarr Core Discloses Sensitive Data via Authenticated Local File Inclusion in selectobject.php CVE-2026-34036 Public exploitFix available 6.5 MediumMarch 27, 2026
• dolibarr erp/crm, erp\/crm +1 more Dolibarr ERP/CRM 10.0.1 SQL Injection via elemid CVE-2019-25452 8.8 HighFebruary 22, 2026
• dolibarr erp/crm, erp\/crm +1 more Dolibarr ERP/CRM 10.0.1 SQL Injection via card.php CVE-2019-25450 7.1 HighFebruary 22, 2026
• churchcrm crm, dolibarr erp\/crm +1 more Dolibarr ERP-CRM 14.0.2 - Stored Cross-Site Scripting (XSS) / Privilege Escalation CVE-2021-47779 8.4 HighJanuary 15, 2026
• dolibarr erp\/crm Dolibarr vulnerable to RCE via the computed field parameter CVE-2025-56588 Fix available 8.8 HighOctober 1, 2025
• dolibarr erp\/crm Dolibarr Cross-site Scripting vulnerability CVE-2024-55228 Fix available 9.0 CriticalJanuary 27, 2025
• dolibarr erp\/crm Dolibarr Cross-site Scripting vulnerability CVE-2024-55227 Fix available 9.0 CriticalJanuary 27, 2025
• dolibarr, dolibarr dolibarr/dolibarr, erp\/crm +2 more Improper Authorization in dolibarr/dolibarr CVE-2021-3991 Fix available 4.3 MediumNovember 15, 2024
• dolibarr erp\/crm Dolibarr ERP CRM vulnerable to remote code execution (RCE) CVE-2024-40137 Fix available 5.5 MediumJuly 24, 2024
• dolibarr erp\/crm Dolibarr arbitrary file upload vulnerability CVE-2024-37821 Fix available 8.8 HighJune 18, 2024
• dolibarr, dolibarr erp cms, erp\/crm +2 more Multiple vulnerabilities in DOLIBARR's ERP CMS CVE-2024-5315 Fix available EPSS 34.5% 9.1 CriticalMay 24, 2024
• dolibarr erp cms, erp\/crm +1 more Multiple vulnerabilities in DOLIBARR's ERP CMS CVE-2024-5314 Fix available 9.1 CriticalMay 24, 2024
• dolibarr erp\/crm Dolibarr vulnerable to Cross-Site Request Forgery CVE-2024-31503 Fix available 7.5 HighApril 16, 2024
• dolibarr erp\/crm Dolibarr ERP CRM Code Injection vulnerability during installation CVE-2024-29477 Fix available 8.8 HighApril 3, 2024
• dolibarr, dolibarr erp\/crm +1 more Dolibarr Application Home Page HTML injection vulnerability CVE-2024-23817 Fix available 7.1 HighJanuary 25, 2024
• dolibarr erp crm, erp\/crm +1 more Dolibarr ERP CRM (<= 17.0.3) Improper Access Control CVE-2023-4198 Fix available 6.5 MediumNovember 1, 2023
• dolibarr erp crm, erp\/crm +1 more Dolibarr ERP CRM (<= 18.0.1) Improper Input Sanitization Authenticated RCE CVE-2023-4197 Public exploitFix available EPSS 36.2% 7.5 HighNovember 1, 2023
• dolibarr, dolibarr dolibarr/dolibarr, erp\/crm +2 more Cross-site Scripting (XSS) - Stored in dolibarr/dolibarr CVE-2023-5842 Fix available 4.8 MediumOctober 30, 2023
• dolibarr, dolibarr dolibarr/dolibarr, erp\/crm +2 more Cross-site Scripting (XSS) - Generic in dolibarr/dolibarr CVE-2023-5323 Fix available 5.4 MediumOctober 1, 2023
• dolibarr erp\/crm Cross Site Scripting vulnerability in Dolibarr ERP CRM CVE-2023-38888 Fix available 9.6 CriticalSeptember 20, 2023
• dolibarr erp\/crm File Upload vulnerability in Dolibarr ERP CRM CVE-2023-38887 Fix available 8.8 HighSeptember 20, 2023
• dolibarr erp\/crm Dolibarr allows a remote privileged attacker to execute arbitrary code via a crafted command/script CVE-2023-38886 Fix available EPSS 29.6% 7.2 HighSeptember 20, 2023
• dolibarr erp\/crm Dolibarr vulnerable to unauthenticated database access CVE-2023-33568 Fix available EPSS 14.9% 7.5 HighJune 13, 2023
• dolibarr erp\/crm Dolibarr vulnerable to remote code execution via uppercase manipulation CVE-2023-30253 Public exploitFix available EPSS 82.1% 8.8 HighMay 29, 2023
• dolibarr dolibarr/dolibarr, erp\/crm +1 more SQL Injection in dolibarr/dolibarr CVE-2022-4093 Fix available 8.1 HighNovember 21, 2022
• dolibarr erp\/crm Dolibarr vulnerable to privilege escalation CVE-2022-43138 Fix available 9.8 CriticalNovember 17, 2022
• dolibarr erp\/crm Dolibarr vulnerable to Eval Injection CVE-2022-40871 EPSS 34.6% 9.8 CriticalOctober 12, 2022
• dolibarr dolibarr/dolibarr, erp\/crm +1 more Cross-site Scripting (XSS) - Stored in dolibarr/dolibarr CVE-2022-2060 Fix available 8.4 HighJune 13, 2022
• dolibarr erp\/crm Cross-site Scripting in Dolibarr CVE-2022-30875 6.1 MediumJune 8, 2022
• dolibarr erp\/crm Access Control vulnerability in Dolibarr CVE-2021-37517 Fix available 7.5 HighMarch 31, 2022
• dolibarr erp\/crm SQL Injection in Dolibarr CVE-2021-36625 Fix available 8.8 HighMarch 31, 2022
• Show olderLoading…