DO
Product
dolibarr
61
CVEs
0
On KEV
9.8
Max CVSS
5
New 30D
Severity mix
Critical 9High 19Medium 31Low 0
Watch
Add dolibarr to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-110874 | 6.6 | Oct 15 | Dolibarr before 23.0.4 PHP Object Injection via jsonOrUnserialize() Affected: before 23.0.4 |
| CVE-2026-89012 | 6.5 | Sep 11 | Dolibarr 24.0.0 < 24.0.1 SQL Filter Denylist Bypass via sqlfilters Parameter Affected: 24.0.0 before 24.0.1 |
| CVE-2026-81729 | 6.5 | Aug 27 | Dolibarr before 23.0.4 Incorrect Authorization on REST API Document Deletion Affected: before 23.0.4 |
| CVE-2026-71511 | 6.5 | Aug 24 | Dolibarr < 24.0.0 Members REST API Sensitive Data Exposure via Member Endpoints Affected: before 24.0.0 |
| CVE-2026-71510 | 6.5 | Aug 24 | Dolibarr < 24.0.0 Users REST API SQL Injection via filter parameter Affected: before 24.0.0 |
| CVE-2026-71509 | 6.5 | Aug 24 | Dolibarr < 24.0.0 Expense Report REST API Improper Authorization via Update Endpoint Affected: before 24.0.0 |
| CVE-2026-71508 | 6.5 | Aug 24 | Dolibarr < 24.0.0 REST API Improper Authorization via User Update Endpoint Affected: before 24.0.0 |
| CVE-2026-71507 | 6.5 | Aug 24 | Dolibarr < 24.0.0 REST API Broken Object-Level Authorization via Bank Account Routes Affected: before 24.0.0 |
| CVE-2026-34036 | 6.5 | Mar 31 | Dolibarr Core Discloses Sensitive Data via Authenticated Local File Inclusion in selectobject.php Affected: <= 22.0.4 |
| CVE-2020-14201 | 6.5 | Aug 21 | Dolibarr CRM before 11.0.5 allows privilege escalation Affected: before 11.0.5 |
| CVE-2020-36966 | 6.4 | Jan 30 | Dolibarr 11.0.3 - 'ldap.php' - Persistent Cross-Site Scripting Affected: through 11.0.3 |
| CVE-2026-112361 | 6.3 | Oct 19 | Dolibarr CSP document.php protection mechanism Affected: 23.0.0; 23.0.1; 23.0.2 |
| CVE-2026-85401 | 6.3 | Sep 4 | Dolibarr Legacy File Manager config.inc.php access control Affected: 21.0.0; 21.0.1; 21.0.2; 21.0.3; 21.0.4; 22.0.0; +9 more |
| CVE-2026-19930 | 6.3 | Aug 16 | Dolibarr User Cloning card.php ldap injection Affected: 23.0.0; 23.0.1; 23.0.2; 23.0.3 |
| CVE-2026-71503 | 6.1 | Aug 24 | Dolibarr < 24.0.0 Reflected XSS via Extra Fields Administration Template Affected: before 24.0.0 |
| CVE-2019-19211 | 6.1 | Mar 16 | Dolibarr ERP/CRM before 10.0.3 has an Insufficient Filtering issue that can lead to user/card.php XSS Affected: 3.0.0 before 10.0.4 |
| CVE-2018-16808 | 6.1 | Mar 7 | An issue was discovered in Dolibarr through 7.0.0 Affected: 3.8.0 through 7.0.0 |
| CVE-2018-19799 | 6.1 | Dec 26 | Dolibarr ERP/CRM through 8.0.3 has /exports/export.php?datatoexport= XSS Affected: through 8.0.3 |
| CVE-2018-10095 | 6.1 | May 22 | Cross-site scripting (XSS) vulnerability in Dolibarr before 7.0.2 allows remote attackers to inject arbitrary web script or HTML via the foruserlogin parameter to… Affected: before 7.0.2 |
| CVE-2015-8685 | 6.1 | Jan 15 | Multiple cross-site scripting (XSS) vulnerabilities in Dolibarr ERP/CRM 3.8.3 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) external… Affected: through 3.8.2 |
| CVE-2026-77686 | 5.4 | Aug 21 | Dolibarr Account card.php improper authorization Affected: 23.0.0; 23.0.1; 23.0.2; 23.0.3; 23.0.4 |
| CVE-2021-42220 | 5.4 | Dec 15 | A Cross Site Scripting (XSS) vulnerability exists in Dolibarr before 14.0.3 via the ticket creation flow Affected: before 14.0.3 |
| CVE-2020-13094 | 5.4 | May 18 | Dolibarr before 11.0.4 allows XSS Affected: before 11.0.4 |
| CVE-2019-19210 | 5.4 | Mar 16 | Dolibarr ERP/CRM before 10.0.3 allows XSS because uploaded HTML documents are served as text/html despite being renamed to .noexe files Affected: 3.0.0 before 10.0.3 |
| CVE-2017-14241 | 5.4 | Sep 11 | Cross-site scripting (XSS) vulnerability in Dolibarr ERP/CRM 6.0.0 allows remote authenticated users to inject arbitrary web script or HTML via the Title parameter to… Affected: 6.0.0 |
| CVE-2017-14239 | 5.4 | Sep 11 | Multiple cross-site scripting (XSS) vulnerabilities in Dolibarr ERP/CRM 6.0.0 allow remote authenticated users to inject arbitrary web script or HTML via the (1) CompanyName, (2)… Affected: 6.0.0 |
| CVE-2016-1912 | 5.4 | Jan 15 | Multiple cross-site scripting (XSS) vulnerabilities in Dolibarr ERP/CRM 3.8.3 allow remote authenticated users to inject arbitrary web script or HTML via the (1) lastname, (2)… Affected: through 3.8.2 |
| CVE-2026-107706 | 4.3 | Oct 8 | Dolibarr before 24.0.2 Incorrect Authorization via updateextrafield.php Affected: before 24.0.2 |
| CVE-2026-82633 | 4.3 | Aug 30 | Dolibarr 10.0.0 before 24.0.0 Missing Authorization on REST Users Groups Endpoint Affected: 10.0.0 before 24.0.0 |
| CVE-2026-77923 | 4.3 | Aug 24 | Dolibarr 21.0.0 < 24.0.0 Authorization Bypass via clonetasks Mass Action Affected: 21.0.0 before 24.0.0 |
| CVE-2021-25954 | 4.3 | Aug 9 | In “Dolibarr” application, 2.8.1 to 13.0.4 don’t restrict or incorrectly restricts access to a resource from an unauthorized actor Affected: 2.8.1 through 13.0.4 |
Showing 31