DO
Product
dolibarr
62
CVEs
0
On KEV
9.8
Max CVSS
5
New 30D
Severity mix
Critical 9High 19Medium 32Low 0
Watch
Add dolibarr to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2020-13094 | 5.4 | May 18 | Dolibarr before 11.0.4 allows XSS Affected: before 11.0.4 |
| CVE-2019-19210 | 5.4 | Mar 16 | Dolibarr ERP/CRM before 10.0.3 allows XSS because uploaded HTML documents are served as text/html despite being renamed to .noexe files Affected: 3.0.0 before 10.0.3 |
| CVE-2017-14241 | 5.4 | Sep 11 | Cross-site scripting (XSS) vulnerability in Dolibarr ERP/CRM 6.0.0 allows remote authenticated users to inject arbitrary web script or HTML via the Title parameter to… Affected: 6.0.0 |
| CVE-2017-14239 | 5.4 | Sep 11 | Multiple cross-site scripting (XSS) vulnerabilities in Dolibarr ERP/CRM 6.0.0 allow remote authenticated users to inject arbitrary web script or HTML via the (1) CompanyName, (2)… Affected: 6.0.0 |
| CVE-2016-1912 | 5.4 | Jan 15 | Multiple cross-site scripting (XSS) vulnerabilities in Dolibarr ERP/CRM 3.8.3 allow remote authenticated users to inject arbitrary web script or HTML via the (1) lastname, (2)… Affected: through 3.8.2 |
| CVE-2026-107706 | 4.3 | Oct 8 | Dolibarr before 24.0.2 Incorrect Authorization via updateextrafield.php Affected: before 24.0.2 |
| CVE-2026-82633 | 4.3 | Aug 30 | Dolibarr 10.0.0 before 24.0.0 Missing Authorization on REST Users Groups Endpoint Affected: 10.0.0 before 24.0.0 |
| CVE-2026-77923 | 4.3 | Aug 24 | Dolibarr 21.0.0 < 24.0.0 Authorization Bypass via clonetasks Mass Action Affected: 21.0.0 before 24.0.0 |
| CVE-2021-3991 | 4.3 | Nov 15 | Improper Authorization in dolibarr/dolibarr Affected: 0 |
| CVE-2021-25954 | 4.3 | Aug 9 | In “Dolibarr” application, 2.8.1 to 13.0.4 don’t restrict or incorrectly restricts access to a resource from an unauthorized actor Affected: 2.8.1 through 13.0.4 |
| CVE-2015-3935 | – | Jun 10 | Multiple cross-site scripting (XSS) vulnerabilities in Dolibarr ERP/CRM 3.5 and 3.6 allow remote attackers to inject arbitrary web script or HTML via the Business Search… Affected: 3.5.0; 3.6.0 |
| CVE-2014-7137 | – | Nov 21 | Multiple SQL injection vulnerabilities in Dolibarr ERP/CRM before 3.6.1 allow remote authenticated users to execute arbitrary SQL commands via the (1) contactid parameter in an… Affected: through 3.6.0 |