DO
Product
dolibarr
61
CVEs
0
On KEV
9.8
Max CVSS
5
New 30D
Severity mix
Critical 9High 19Medium 31Low 0
Watch
Add dolibarr to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2019-19212 | 9.8 | Mar 16 | Dolibarr ERP/CRM 3.0 through 10.0.3 allows XSS via the qty parameter to product/fournisseurs.php (product price screen) Affected: 3.0.0 through 10.0.3 |
| CVE-2018-16809 | 9.8 | Mar 7 | An issue was discovered in Dolibarr through 7.0.0 Affected: 3.8.0 through 7.0.0 |
| CVE-2018-9019 | 9.8 | May 22 | SQL Injection vulnerability in Dolibarr before version 7.0.2 allows remote attackers to execute arbitrary SQL commands via the sortfield parameter to… Affected: before 7.0.2 |
| CVE-2018-10094 | 9.8 | May 22 | SQL injection vulnerability in Dolibarr before 7.0.2 allows remote attackers to execute arbitrary SQL commands via vectors involving integer parameters without quotes Affected: before 7.0.2 |
| CVE-2017-14242 | 9.8 | Sep 11 | SQL injection vulnerability in don/list.php in Dolibarr version 6.0.0 allows remote attackers to execute arbitrary SQL commands via the statut parameter Affected: 6.0.0 |
| CVE-2017-14238 | 9.8 | Sep 11 | SQL injection vulnerability in admin/menus/edit.php in Dolibarr ERP/CRM version 6.0.0 allows remote attackers to execute arbitrary SQL commands via the menuId parameter Affected: 6.0.0 |
| CVE-2017-9435 | 9.8 | Jun 5 | Dolibarr ERP/CRM before 5.0.3 is vulnerable to a SQL injection in user/index.php (search_supervisor and search_statut parameters) Affected: through 5.0.2 |
| CVE-2026-23500 | 9.1 | Apr 17 | Dolibarr: OS Command Injection (RCE) via MAIN_ODT_AS_PDF configuration Affected: < 23.0.0 |
| CVE-2021-25955 | 9.0 | Aug 15 | In “Dolibarr ERP CRM”, WYSIWYG Editor module, v2.8.1 to v13.0.2 are affected by a stored XSS vulnerability that allows low privileged application users to store malicious scripts… Affected: 2.8.1 through 13.0.2 |
| CVE-2021-25957 | 8.8 | Aug 17 | In “Dolibarr” application, v2.8.1 to v13.0.2 are vulnerable to account takeover via password reset functionality Affected: 2.8.1 through 13.0.2 |
| CVE-2020-14209 | 8.8 | Sep 2 | Dolibarr before 11.0.5 allows low-privilege users to upload files of dangerous types, leading to arbitrary code execution Affected: before 11.0.5 |
| CVE-2020-14443 | 8.8 | Jun 18 | A SQL injection vulnerability in accountancy/customer/card.php in Dolibarr 11.0.3 allows remote authenticated users to execute arbitrary SQL commands via the id parameter Affected: through 11.0.3 |
| CVE-2020-12669 | 8.8 | May 6 | core/get_menudiv.php in Dolibarr before 11.0.4 allows remote authenticated attackers to bypass intended access restrictions via a non-alphanumeric menu parameter Affected: before 11.0.4 |
| CVE-2017-9840 | 8.8 | Jun 25 | Dolibarr ERP/CRM 5.0.3 and prior allows low-privilege users to upload files of dangerous types, which can result in arbitrary code execution within the context of the vulnerable… Affected: through 5.0.3 |
| CVE-2026-81730 | 8.2 | Aug 27 | Dolibarr 9.0.0 through 23.0.4 Path Traversal via EmailCollector Attachment Filename Affected: 9.0.0 before 24.0.0 |
| CVE-2026-81728 | 8.1 | Aug 27 | Dolibarr before 24.0.0 SQL Injection via the CSV and XLSX Import Update Keys Affected: before 24.0.0 |
| CVE-2026-71506 | 8.1 | Aug 24 | Dolibarr < 24.0.0 Payments REST API Improper Authorization via Delete Endpoint Affected: before 24.0.0 |
| CVE-2026-71504 | 8.1 | Aug 24 | Dolibarr < 24.0.0 Members REST API Improper Authorization via Password Reset Affected: before 24.0.0 |
| CVE-2018-10092 | 8.0 | May 22 | The admin panel in Dolibarr before 7.0.2 might allow remote attackers to execute arbitrary commands by leveraging support for updating the antivirus command and parameters used to… Affected: before 7.0.2 |
| CVE-2026-116218 New | 7.6 | Oct 26 | Dolibarr ERP CRM 19.0.0 before 23.0.4 SQL Injection via bankaccounts API type field Affected: 19.0.0 before 23.0.4 |
| CVE-2026-58376 | 7.6 | Jun 30 | Dolibarr - SQL Injection via sqlfilters Parameter in Multiple REST API List Endpoints Affected: through 23.0.3 |
| CVE-2026-89013 | 7.5 | Sep 11 | Dolibarr 23.0.4 < 24.0.1 Authorization Bypass via hashp Parameter in document.php Affected: 23.0.4 before 24.0.1 |
| CVE-2019-19209 | 7.5 | Mar 16 | Dolibarr ERP/CRM before 10.0.3 allows SQL Injection Affected: 3.0.0 before 10.0.3 |
| CVE-2017-14240 | 7.5 | Sep 11 | There is a sensitive information disclosure vulnerability in document.php in Dolibarr ERP/CRM version 6.0.0 via the file parameter Affected: 6.0.0 |
| CVE-2026-116219 New | 7.2 | Oct 26 | Dolibarr ERP CRM before 24.0.0 OS Command Injection via mysqldump Parameter Affected: before 24.0.0 |
| CVE-2025-67486 | 7.2 | May 8 | Dolibarr has an Authenticated Remote Code Execution via eval() injection in user extrafields Affected: <= 22.0.2 |
| CVE-2021-25956 | 7.2 | Aug 17 | In “Dolibarr” application, v3.3.beta1_20121221 to v13.0.2 have “Modify” access for admin level users to change other user’s details but fails to validate already existing “Login”… Affected: 3.3.1 through 13.0.2 |
| CVE-2026-71505 | 7.1 | Aug 24 | Dolibarr < 24.0.0 REST API Broken Object-Level Authorization via Third-Party Write Route Affected: before 24.0.0 |
| CVE-2026-110874 | 6.6 | Oct 15 | Dolibarr before 23.0.4 PHP Object Injection via jsonOrUnserialize() Affected: before 23.0.4 |
| CVE-2026-89012 | 6.5 | Sep 11 | Dolibarr 24.0.0 < 24.0.1 SQL Filter Denylist Bypass via sqlfilters Parameter Affected: 24.0.0 before 24.0.1 |
| CVE-2026-81729 | 6.5 | Aug 27 | Dolibarr before 23.0.4 Incorrect Authorization on REST API Document Deletion Affected: before 23.0.4 |
| CVE-2026-71511 | 6.5 | Aug 24 | Dolibarr < 24.0.0 Members REST API Sensitive Data Exposure via Member Endpoints Affected: before 24.0.0 |
| CVE-2026-71510 | 6.5 | Aug 24 | Dolibarr < 24.0.0 Users REST API SQL Injection via filter parameter Affected: before 24.0.0 |
| CVE-2026-71509 | 6.5 | Aug 24 | Dolibarr < 24.0.0 Expense Report REST API Improper Authorization via Update Endpoint Affected: before 24.0.0 |
| CVE-2026-71508 | 6.5 | Aug 24 | Dolibarr < 24.0.0 REST API Improper Authorization via User Update Endpoint Affected: before 24.0.0 |
| CVE-2026-71507 | 6.5 | Aug 24 | Dolibarr < 24.0.0 REST API Broken Object-Level Authorization via Bank Account Routes Affected: before 24.0.0 |
| CVE-2026-34036 | 6.5 | Mar 31 | Dolibarr Core Discloses Sensitive Data via Authenticated Local File Inclusion in selectobject.php Affected: <= 22.0.4 |
| CVE-2020-14201 | 6.5 | Aug 21 | Dolibarr CRM before 11.0.5 allows privilege escalation Affected: before 11.0.5 |
| CVE-2020-36966 | 6.4 | Jan 30 | Dolibarr 11.0.3 - 'ldap.php' - Persistent Cross-Site Scripting Affected: through 11.0.3 |
| CVE-2026-112361 | 6.3 | Oct 19 | Dolibarr CSP document.php protection mechanism Affected: 23.0.0; 23.0.1; 23.0.2 |
| CVE-2026-85401 | 6.3 | Sep 4 | Dolibarr Legacy File Manager config.inc.php access control Affected: 21.0.0; 21.0.1; 21.0.2; 21.0.3; 21.0.4; 22.0.0; +9 more |
| CVE-2026-19930 | 6.3 | Aug 16 | Dolibarr User Cloning card.php ldap injection Affected: 23.0.0; 23.0.1; 23.0.2; 23.0.3 |
| CVE-2026-71503 | 6.1 | Aug 24 | Dolibarr < 24.0.0 Reflected XSS via Extra Fields Administration Template Affected: before 24.0.0 |
| CVE-2019-19211 | 6.1 | Mar 16 | Dolibarr ERP/CRM before 10.0.3 has an Insufficient Filtering issue that can lead to user/card.php XSS Affected: 3.0.0 before 10.0.4 |
| CVE-2018-16808 | 6.1 | Mar 7 | An issue was discovered in Dolibarr through 7.0.0 Affected: 3.8.0 through 7.0.0 |
| CVE-2018-19799 | 6.1 | Dec 26 | Dolibarr ERP/CRM through 8.0.3 has /exports/export.php?datatoexport= XSS Affected: through 8.0.3 |
| CVE-2018-10095 | 6.1 | May 22 | Cross-site scripting (XSS) vulnerability in Dolibarr before 7.0.2 allows remote attackers to inject arbitrary web script or HTML via the foruserlogin parameter to… Affected: before 7.0.2 |
| CVE-2015-8685 | 6.1 | Jan 15 | Multiple cross-site scripting (XSS) vulnerabilities in Dolibarr ERP/CRM 3.8.3 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) external… Affected: through 3.8.2 |
| CVE-2026-77686 | 5.4 | Aug 21 | Dolibarr Account card.php improper authorization Affected: 23.0.0; 23.0.1; 23.0.2; 23.0.3; 23.0.4 |
| CVE-2021-42220 | 5.4 | Dec 15 | A Cross Site Scripting (XSS) vulnerability exists in Dolibarr before 14.0.3 via the ticket creation flow Affected: before 14.0.3 |