DO
Vendor
Dolibarr
188
CVEs
0
On KEV
6
New 30D
Products
DO9.8
dolibarr
Dolibarr
64 CVEs0 on KEV5 new
DE9.8
Dolibarr ERP/CRM
Dolibarr
113 CVEs0 on KEV1 new
EC6.3
ERP CRM
Dolibarr
5 CVEs0 on KEV0 new
ER6.3
ERP
Dolibarr
2 CVEs0 on KEV0 new
EC9.1
ERP CMS
Dolibarr
2 CVEs0 on KEV0 new
CR5.4
CRM
Dolibarr
1 CVEs0 on KEV0 new
DO4.3
dolibarr/dolibarr
dolibarr
1 CVEs0 on KEV0 new
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-118754 New | DE Dolibarr ERP/CRM Dolibarr | 5.3 | Oct 28 | Dolibarr ERP CRM before 24.0.2 Missing Authorization via public recruitment view.php |
| CVE-2026-116219 New | DO dolibarr Dolibarr | 7.2 | Oct 26 | Dolibarr ERP CRM before 24.0.0 OS Command Injection via mysqldump Parameter |
| CVE-2026-116218 New | DO dolibarr Dolibarr | 7.6 | Oct 26 | Dolibarr ERP CRM 19.0.0 before 23.0.4 SQL Injection via bankaccounts API type field |
| CVE-2026-112361 | DO Dolibarr Dolibarr | 6.3 | Oct 19 | Dolibarr CSP document.php protection mechanism |
| CVE-2026-110874 | DO dolibarr Dolibarr | 6.6 | Oct 15 | Dolibarr before 23.0.4 PHP Object Injection via jsonOrUnserialize() |
| CVE-2026-107706 | DO dolibarr Dolibarr | 4.3 | Oct 8 | Dolibarr before 24.0.2 Incorrect Authorization via updateextrafield.php |
| CVE-2026-89013 | DO Dolibarr Dolibarr | 7.5 | Sep 11 | Dolibarr 23.0.4 < 24.0.1 Authorization Bypass via hashp Parameter in document.php |
| CVE-2026-89012 | DO Dolibarr Dolibarr | 6.5 | Sep 11 | Dolibarr 24.0.0 < 24.0.1 SQL Filter Denylist Bypass via sqlfilters Parameter |
| CVE-2026-85401 | DO Dolibarr Dolibarr | 6.3 | Sep 4 | Dolibarr Legacy File Manager config.inc.php access control |
| CVE-2026-82633 | DO dolibarr Dolibarr | 4.3 | Aug 30 | Dolibarr 10.0.0 before 24.0.0 Missing Authorization on REST Users Groups Endpoint |
| CVE-2026-81730 | DO dolibarr Dolibarr | 8.2 | Aug 27 | Dolibarr 9.0.0 through 23.0.4 Path Traversal via EmailCollector Attachment Filename |
| CVE-2026-81729 | DO dolibarr Dolibarr | 6.5 | Aug 27 | Dolibarr before 23.0.4 Incorrect Authorization on REST API Document Deletion |
| CVE-2026-81728 | DO dolibarr Dolibarr | 8.1 | Aug 27 | Dolibarr before 24.0.0 SQL Injection via the CSV and XLSX Import Update Keys |
| CVE-2026-77923 | DO dolibarr Dolibarr | 4.3 | Aug 24 | Dolibarr 21.0.0 < 24.0.0 Authorization Bypass via clonetasks Mass Action |
| CVE-2026-71511 | DO dolibarr Dolibarr | 6.5 | Aug 24 | Dolibarr < 24.0.0 Members REST API Sensitive Data Exposure via Member Endpoints |
| CVE-2026-71510 | DO dolibarr Dolibarr | 6.5 | Aug 24 | Dolibarr < 24.0.0 Users REST API SQL Injection via filter parameter |
| CVE-2026-71509 | DO dolibarr Dolibarr | 6.5 | Aug 24 | Dolibarr < 24.0.0 Expense Report REST API Improper Authorization via Update Endpoint |
| CVE-2026-71508 | DO dolibarr Dolibarr | 6.5 | Aug 24 | Dolibarr < 24.0.0 REST API Improper Authorization via User Update Endpoint |
| CVE-2026-71507 | DO dolibarr Dolibarr | 6.5 | Aug 24 | Dolibarr < 24.0.0 REST API Broken Object-Level Authorization via Bank Account Routes |
| CVE-2026-71506 | DO dolibarr Dolibarr | 8.1 | Aug 24 | Dolibarr < 24.0.0 Payments REST API Improper Authorization via Delete Endpoint |
| CVE-2026-71505 | DO dolibarr Dolibarr | 7.1 | Aug 24 | Dolibarr < 24.0.0 REST API Broken Object-Level Authorization via Third-Party Write Route |
| CVE-2026-71504 | DO dolibarr Dolibarr | 8.1 | Aug 24 | Dolibarr < 24.0.0 Members REST API Improper Authorization via Password Reset |
| CVE-2026-71503 | DO dolibarr Dolibarr | 6.1 | Aug 24 | Dolibarr < 24.0.0 Reflected XSS via Extra Fields Administration Template |
| CVE-2026-78160 | ER ERP Dolibarr | 6.3 | Aug 24 | Dolibarr ERP User Notes note.php authorization |
| CVE-2026-77686 | DO Dolibarr Dolibarr | 5.4 | Aug 21 | Dolibarr Account card.php improper authorization |
| CVE-2026-19930 | DO Dolibarr Dolibarr | 6.3 | Aug 16 | Dolibarr User Cloning card.php ldap injection |
| CVE-2026-19350 | ER ERP Dolibarr | 6.3 | Aug 9 | Dolibarr ERP TakePOS invoice.php fail authorization |
| CVE-2026-58376 | DO dolibarr Dolibarr | 7.6 | Jun 30 | Dolibarr - SQL Injection via sqlfilters Parameter in Multiple REST API List Endpoints |
| CVE-2026-11619 | EC ERP CRM Dolibarr | 6.3 | Jun 9 | Dolibarr ERP CRM Legacy Filemanager config.inc.php improper authorization |
| CVE-2026-10215 | EC ERP CRM Dolibarr | 4.3 | Jun 1 | Dolibarr ERP CRM Leave Request REST API api_holidays.class.php checkUserAccessToObject improper authorization |
| CVE-2026-10154 | EC ERP CRM Dolibarr | 4.3 | May 30 | Dolibarr ERP CRM messaging.php authorization |
| CVE-2018-25357 | DE Dolibarr ERP CRM Dolibarr | 9.8 | May 23 | Dolibarr ERP CRM 7.0.3 Remote Code Execution via install/step1.php |
| CVE-2025-67486 | DO dolibarr Dolibarr | 7.2 | May 8 | Dolibarr has an Authenticated Remote Code Execution via eval() injection in user extrafields |
| CVE-2026-7689 | EC ERP CRM Dolibarr | 3.7 | May 3 | Dolibarr ERP CRM Online Signature security.lib.php dol_verifyHash signature verification |
| CVE-2026-7688 | EC ERP CRM Dolibarr | 5.0 | May 3 | Dolibarr ERP CRM Shipments API Endpoint expedition.class.php _checkValForAPI sql injection |
| CVE-2026-31018 | DE Dolibarr Erp/crm Dolibarr | 8.8 | Apr 21 | In Dolibarr ERP & CRM <= 22.0.4, PHP code detection and editing permission enforcement in the Website module is not applied consistently to all input parameters, allowing an… |
| CVE-2026-31019 | DE Dolibarr Erp/crm Dolibarr | 8.8 | Apr 21 | In the Website module of Dolibarr ERP & CRM 22.0.4 and below, the application uses blacklist-based filtering to restrict dangerous PHP functions related to system command… |
| CVE-2026-23500 | DO dolibarr Dolibarr | 9.1 | Apr 17 | Dolibarr: OS Command Injection (RCE) via MAIN_ODT_AS_PDF configuration |
| CVE-2019-25710 | DE Dolibarr ERP-CRM Dolibarr | 9.1 | Apr 12 | Dolibarr ERP-CRM 8.0.4 SQL Injection via rowid Parameter |
| CVE-2026-22666 | DE Dolibarr ERP/CRM Dolibarr | 7.2 | Apr 7 | Dolibarr ERP/CRM < 23.0.2 Authenticated RCE via dol_eval_standard() |
| CVE-2026-34036 | DO dolibarr Dolibarr | 6.5 | Mar 31 | Dolibarr Core Discloses Sensitive Data via Authenticated Local File Inclusion in selectobject.php |
| CVE-2019-25452 | DE Dolibarr ERP/CRM Dolibarr | 7.5 | Feb 22 | Dolibarr ERP/CRM 10.0.1 SQL Injection via elemid |
| CVE-2019-25450 | DE Dolibarr ERP/CRM Dolibarr | 7.5 | Feb 22 | Dolibarr ERP/CRM 10.0.1 SQL Injection via card.php |
| CVE-2020-36966 | DO Dolibarr Dolibarr | 6.4 | Jan 30 | Dolibarr 11.0.3 - 'ldap.php' - Persistent Cross-Site Scripting |
| CVE-2021-47779 | CR CRM Dolibarr | 5.4 | Jan 15 | Dolibarr ERP-CRM 14.0.2 - Stored Cross-Site Scripting (XSS) / Privilege Escalation |
| CVE-2025-56588 | DE Dolibarr Erp/crm Dolibarr | 8.8 | Oct 1 | Dolibarr ERP & CRM v21.0.1 were discovered to contain a remote code execution (RCE) vulnerability in the User module configuration via the computed field parameter |
| CVE-2024-55228 | DE Dolibarr Erp/crm Dolibarr | 9.0 | Jan 27 | A cross-site scripting (XSS) vulnerability in the Product module of Dolibarr v21.0.0-beta allows attackers to execute arbitrary web scripts or HTMl via a crafted payload injected… |
| CVE-2024-55227 | DE Dolibarr Erp/crm Dolibarr | 9.0 | Jan 27 | A cross-site scripting (XSS) vulnerability in the Events/Agenda module of Dolibarr v21.0.0-beta allows attackers to execute arbitrary web scripts or HTMl via a crafted payload… |
| CVE-2021-3991 | DO dolibarr/dolibarr dolibarr | 4.3 | Nov 15 | Improper Authorization in dolibarr/dolibarr |
| CVE-2024-40137 | DE Dolibarr Erp\/crm Dolibarr | 5.5 | Jul 24 | Dolibarr ERP CRM before 19.0.2-php8.2 was discovered to contain a remote code execution (RCE) vulnerability via the Computed field parameter under the Users Module Setup function |
| CVE-2024-37821 | DE Dolibarr Erp/crm Dolibarr | 8.8 | Jun 18 | An arbitrary file upload vulnerability in the Upload Template function of Dolibarr ERP CRM up to v19.0.1 allows attackers to execute arbitrary code via uploading a crafted .SQL… |
| CVE-2024-34051 | DO Dolibarr Dolibarr | 4.6 | Jun 3 | A Reflected Cross-site scripting (XSS) vulnerability located in htdocs/compta/paiement/card.php of Dolibarr before 19.0.2 allows remote attackers to inject arbitrary web script or… |
| CVE-2024-5315 | EC ERP CMS Dolibarr | 9.1 | May 24 | Multiple vulnerabilities in DOLIBARR's ERP CMS |
| CVE-2024-5314 | EC ERP CMS Dolibarr | 9.1 | May 24 | Multiple vulnerabilities in DOLIBARR's ERP CMS |
| CVE-2024-31503 | DE Dolibarr Erp/crm Dolibarr | 7.5 | Apr 17 | Incorrect access control in Dolibarr ERP CRM versions 19.0.0 and before, allows authenticated attackers to steal victim users' session cookies and CSRF protection tokens via user… |
| CVE-2024-29477 | DE Dolibarr Erp/crm Dolibarr | 8.8 | Apr 3 | Lack of sanitization during Installation Process in Dolibarr ERP CRM up to version 19.0.0 allows an attacker with adjacent access to the network to execute arbitrary code via a… |
| CVE-2024-23817 | DE Dolibarr Erp/crm Dolibarr | 6.1 | Jan 25 | Dolibarr is an enterprise resource planning (ERP) and customer relationship management (CRM) software package |
| CVE-2023-4198 | DE Dolibarr Erp/crm Dolibarr | 6.5 | Nov 1 | Improper Access Control in Dolibarr ERP CRM <= v17.0.3 allows an unauthorized authenticated user to read a database table containing customer data |
| CVE-2023-4197 | DE Dolibarr Erp/crm Dolibarr | 8.8 | Nov 1 | Improper input validation in Dolibarr ERP CRM <= v18.0.1 fails to strip certain PHP code from user-supplied input when creating a Website, allowing an attacker to inject and… |
| CVE-2023-5842 | DE Dolibarr Erp/crm Dolibarr | 4.8 | Oct 30 | Cross-site Scripting (XSS) - Stored in GitHub repository dolibarr/dolibarr prior to 16.0.5 |