DO
Product
dolibarr
67
CVEs
0
On KEV
9.8
Max CVSS
5
New 30D
Severity mix
Critical 10High 19Medium 36Low 0
Watch
Add dolibarr to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2015-8685 | 6.1 | Jan 15 | Multiple cross-site scripting (XSS) vulnerabilities in Dolibarr ERP/CRM 3.8.3 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) external… Affected: through 3.8.2 |
| CVE-2026-77686 | 5.4 | Aug 21 | Dolibarr Account card.php improper authorization Affected: 23.0.0; 23.0.1; 23.0.2; 23.0.3; 23.0.4 |
| CVE-2021-42220 | 5.4 | Dec 15 | A Cross Site Scripting (XSS) vulnerability exists in Dolibarr before 14.0.3 via the ticket creation flow Affected: before 14.0.3 |
| CVE-2020-13094 | 5.4 | May 18 | Dolibarr before 11.0.4 allows XSS Affected: before 11.0.4 |
| CVE-2019-19210 | 5.4 | Mar 16 | Dolibarr ERP/CRM before 10.0.3 allows XSS because uploaded HTML documents are served as text/html despite being renamed to .noexe files Affected: 3.0.0 before 10.0.3 |
| CVE-2017-14241 | 5.4 | Sep 11 | Cross-site scripting (XSS) vulnerability in Dolibarr ERP/CRM 6.0.0 allows remote authenticated users to inject arbitrary web script or HTML via the Title parameter to… Affected: 6.0.0 |
| CVE-2017-14239 | 5.4 | Sep 11 | Multiple cross-site scripting (XSS) vulnerabilities in Dolibarr ERP/CRM 6.0.0 allow remote authenticated users to inject arbitrary web script or HTML via the (1) CompanyName, (2)… Affected: 6.0.0 |
| CVE-2016-1912 | 5.4 | Jan 15 | Multiple cross-site scripting (XSS) vulnerabilities in Dolibarr ERP/CRM 3.8.3 allow remote authenticated users to inject arbitrary web script or HTML via the (1) lastname, (2)… Affected: through 3.8.2 |
| CVE-2023-5842 | 4.8 | Oct 30 | Cross-site Scripting (XSS) - Stored in dolibarr/dolibarr Affected: before 16.0.5 |
| CVE-2024-34051 | 4.6 | Jun 3 | A Reflected Cross-site scripting (XSS) vulnerability located in htdocs/compta/paiement/card.php of Dolibarr before 19.0.2 allows remote attackers to inject arbitrary web script or… Affected: before 19.0.2 |
| CVE-2026-107706 | 4.3 | Oct 8 | Dolibarr before 24.0.2 Incorrect Authorization via updateextrafield.php Affected: before 24.0.2 |
| CVE-2026-82633 | 4.3 | Aug 30 | Dolibarr 10.0.0 before 24.0.0 Missing Authorization on REST Users Groups Endpoint Affected: 10.0.0 before 24.0.0 |
| CVE-2026-77923 | 4.3 | Aug 24 | Dolibarr 21.0.0 < 24.0.0 Authorization Bypass via clonetasks Mass Action Affected: 21.0.0 before 24.0.0 |
| CVE-2021-3991 | 4.3 | Nov 15 | Improper Authorization in dolibarr/dolibarr Affected: 0 |
| CVE-2021-25954 | 4.3 | Aug 9 | Improper Access Control in “Dolibarr” Affected: 2.8.1 before unspecified; through 13.0.4 |
| CVE-2015-3935 | – | Jun 10 | Multiple cross-site scripting (XSS) vulnerabilities in Dolibarr ERP/CRM 3.5 and 3.6 allow remote attackers to inject arbitrary web script or HTML via the Business Search… Affected: 3.5.0; 3.6.0 |
| CVE-2014-7137 | – | Nov 21 | Multiple SQL injection vulnerabilities in Dolibarr ERP/CRM before 3.6.1 allow remote authenticated users to execute arbitrary SQL commands via the (1) contactid parameter in an… Affected: through 3.6.0 |