DE
Product
Dolibarr ERP/CRM
112
CVEs
0
On KEV
9.8
Max CVSS
1
New 30D
Severity mix
Critical 25High 32Medium 48Low 0
Watch
Add Dolibarr ERP/CRM to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2018-25357 | 9.8 | May 23 | Dolibarr ERP CRM 7.0.3 Remote Code Execution via install/step1.php Affected: through 7.0.3 |
| CVE-2022-4093 | 9.8 | Nov 21 | SQL injection attacks can result in unauthorized access to sensitive data, such as passwords, credit card details, or personal user information Affected: 16.0.1; 16.0.2 |
| CVE-2022-43138 | 9.8 | Nov 17 | Dolibarr Open Source ERP & CRM for Business before v14.0.1 allows attackers to escalate privileges via a crafted API Affected: before 14.0.1 |
| CVE-2022-40871 | 9.8 | Oct 12 | Dolibarr ERP & CRM <=15.0.3 is vulnerable to Eval injection Affected: through 15.0.3 |
| CVE-2022-0224 | 9.8 | Jan 14 | dolibarr is vulnerable to Improper Neutralization of Special Elements used in an SQL Command Affected: before 15.0.0 |
| CVE-2021-33816 | 9.8 | Nov 10 | The website builder module in Dolibarr 13.0.2 allows remote PHP code execution because of an incomplete protection mechanism in which system, exec, and shell_exec are blocked but… Affected: 13.0.2 |
| CVE-2020-7995 | 9.8 | Jan 26 | The htdocs/index.php?mainmenu=home login page in Dolibarr 10.0.6 allows an unlimited rate of failed authentication attempts Affected: 10.0.6 |
| CVE-2013-2093 | 9.8 | Nov 20 | Dolibarr ERP/CRM 3.3.1 does not properly validate user input in viewimage.php and barcode.lib.php which allows remote attackers to execute arbitrary commands Affected: 3.3.1 |
| CVE-2013-2091 | 9.8 | Nov 20 | SQL injection vulnerability in Dolibarr ERP/CRM 3.3.1 allows remote attackers to execute arbitrary SQL commands via the 'pays' parameter in fiche.php Affected: 3.3.1 |
| CVE-2018-13450 | 9.8 | Jul 8 | SQL injection vulnerability in product/card.php in Dolibarr ERP/CRM version 7.0.3 allows remote attackers to execute arbitrary SQL commands via the status_batch parameter Affected: 7.0.3 |
| CVE-2018-13449 | 9.8 | Jul 8 | SQL injection vulnerability in product/card.php in Dolibarr ERP/CRM version 7.0.3 allows remote attackers to execute arbitrary SQL commands via the statut_buy parameter Affected: 7.0.3 |
| CVE-2018-13448 | 9.8 | Jul 8 | SQL injection vulnerability in product/card.php in Dolibarr ERP/CRM version 7.0.3 allows remote attackers to execute arbitrary SQL commands via the country_id parameter Affected: 7.0.3 |
| CVE-2018-13447 | 9.8 | Jul 8 | SQL injection vulnerability in product/card.php in Dolibarr ERP/CRM version 7.0.3 allows remote attackers to execute arbitrary SQL commands via the statut parameter Affected: 7.0.3 |
| CVE-2017-17900 | 9.8 | Dec 27 | SQL injection vulnerability in fourn/index.php in Dolibarr ERP/CRM version 6.0.4 allows remote attackers to execute arbitrary SQL commands via the socid parameter Affected: 6.0.4 |
| CVE-2017-17899 | 9.8 | Dec 27 | SQL injection vulnerability in adherents/subscription/info.php in Dolibarr ERP/CRM version 6.0.4 allows remote attackers to execute arbitrary SQL commands via the rowid parameter Affected: 6.0.4 |
| CVE-2017-17897 | 9.8 | Dec 27 | SQL injection vulnerability in comm/multiprix.php in Dolibarr ERP/CRM version 6.0.4 allows remote attackers to execute arbitrary SQL commands via the id parameter Affected: 6.0.4 |
| CVE-2017-7888 | 9.8 | May 10 | Dolibarr ERP/CRM 4.0.4 stores passwords with the MD5 algorithm, which makes brute-force attacks easier Affected: 4.0.4 |
| CVE-2017-7886 | 9.8 | May 10 | Dolibarr ERP/CRM 4.0.4 has SQL Injection in doli/theme/eldy/style.css.php via the lang parameter Affected: 4.0.4 |
| CVE-2023-38888 | 9.6 | Sep 20 | Cross Site Scripting vulnerability in Dolibarr ERP CRM v.17.0.1 and before allows a remote attacker to obtain sensitive information and execute arbitrary code via the REST API… Affected: through 17.0.1 |
| CVE-2026-23500 | 9.1 | Apr 17 | Dolibarr: OS Command Injection (RCE) via MAIN_ODT_AS_PDF configuration Affected: before 23.0.0 |
| CVE-2019-25710 | 9.1 | Apr 12 | Dolibarr ERP-CRM 8.0.4 SQL Injection via rowid Parameter Affected: 8.0.4 |
| CVE-2024-5315 | 9.1 | May 24 | Vulnerabilities in Dolibarr ERP - CRM that affect version 9.0.1 and allow SQL injection Affected: 9.0.1 |
| CVE-2024-5314 | 9.1 | May 24 | Vulnerabilities in Dolibarr ERP - CRM that affect version 9.0.1 and allow SQL injection Affected: 9.0.1 |
| CVE-2024-55228 | 9.0 | Jan 27 | A cross-site scripting (XSS) vulnerability in the Product module of Dolibarr v21.0.0-beta allows attackers to execute arbitrary web scripts or HTMl via a crafted payload injected… Affected: 21.0.0 |
| CVE-2024-55227 | 9.0 | Jan 27 | A cross-site scripting (XSS) vulnerability in the Events/Agenda module of Dolibarr v21.0.0-beta allows attackers to execute arbitrary web scripts or HTMl via a crafted payload… Affected: 21.0.0 |
Showing 25