DO
Product
dolibarr
64
CVEs
0
On KEV
9.8
Max CVSS
5
New 30D
Severity mix
Critical 10High 19Medium 33Low 0
Watch
Add dolibarr to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2021-25957 | 8.8 | Aug 17 | In “Dolibarr” application, v2.8.1 to v13.0.2 are vulnerable to account takeover via password reset functionality Affected: 2.8.1 through 13.0.2 |
| CVE-2020-14209 | 8.8 | Sep 2 | Dolibarr before 11.0.5 allows low-privilege users to upload files of dangerous types, leading to arbitrary code execution Affected: before 11.0.5 |
| CVE-2020-14443 | 8.8 | Jun 18 | A SQL injection vulnerability in accountancy/customer/card.php in Dolibarr 11.0.3 allows remote authenticated users to execute arbitrary SQL commands via the id parameter Affected: through 11.0.3 |
| CVE-2020-12669 | 8.8 | May 6 | core/get_menudiv.php in Dolibarr before 11.0.4 allows remote authenticated attackers to bypass intended access restrictions via a non-alphanumeric menu parameter Affected: before 11.0.4 |
| CVE-2017-9840 | 8.8 | Jun 25 | Dolibarr ERP/CRM 5.0.3 and prior allows low-privilege users to upload files of dangerous types, which can result in arbitrary code execution within the context of the vulnerable… Affected: through 5.0.3 |
| CVE-2026-81730 | 8.2 | Aug 27 | Dolibarr 9.0.0 through 23.0.4 Path Traversal via EmailCollector Attachment Filename Affected: 9.0.0 before 24.0.0 |
| CVE-2026-81728 | 8.1 | Aug 27 | Dolibarr before 24.0.0 SQL Injection via the CSV and XLSX Import Update Keys Affected: before 24.0.0 |
| CVE-2026-71506 | 8.1 | Aug 24 | Dolibarr < 24.0.0 Payments REST API Improper Authorization via Delete Endpoint Affected: before 24.0.0 |
| CVE-2026-71504 | 8.1 | Aug 24 | Dolibarr < 24.0.0 Members REST API Improper Authorization via Password Reset Affected: before 24.0.0 |
| CVE-2018-10092 | 8.0 | May 22 | The admin panel in Dolibarr before 7.0.2 might allow remote attackers to execute arbitrary commands by leveraging support for updating the antivirus command and parameters used to… Affected: before 7.0.2 |
| CVE-2026-116218 New | 7.6 | Oct 26 | Dolibarr ERP CRM 19.0.0 before 23.0.4 SQL Injection via bankaccounts API type field Affected: 19.0.0 before 23.0.4 |
| CVE-2026-58376 | 7.6 | Jun 30 | Dolibarr - SQL Injection via sqlfilters Parameter in Multiple REST API List Endpoints Affected: through 23.0.3 |
| CVE-2026-89013 | 7.5 | Sep 11 | Dolibarr 23.0.4 < 24.0.1 Authorization Bypass via hashp Parameter in document.php Affected: 23.0.4 before 24.0.1 |
| CVE-2019-19209 | 7.5 | Mar 16 | Dolibarr ERP/CRM before 10.0.3 allows SQL Injection Affected: 3.0.0 before 10.0.3 |
| CVE-2017-14240 | 7.5 | Sep 11 | There is a sensitive information disclosure vulnerability in document.php in Dolibarr ERP/CRM version 6.0.0 via the file parameter Affected: 6.0.0 |
| CVE-2026-116219 New | 7.2 | Oct 26 | Dolibarr ERP CRM before 24.0.0 OS Command Injection via mysqldump Parameter Affected: before 24.0.0 |
| CVE-2025-67486 | 7.2 | May 8 | Dolibarr has an Authenticated Remote Code Execution via eval() injection in user extrafields Affected: <= 22.0.2 |
| CVE-2021-25956 | 7.2 | Aug 17 | In “Dolibarr” application, v3.3.beta1_20121221 to v13.0.2 have “Modify” access for admin level users to change other user’s details but fails to validate already existing “Login”… Affected: 3.3.1 through 13.0.2 |
| CVE-2026-71505 | 7.1 | Aug 24 | Dolibarr < 24.0.0 REST API Broken Object-Level Authorization via Third-Party Write Route Affected: before 24.0.0 |
Showing 19