Dolibarr

Products

Exploited and recent CVEs

• CVE-2026-33944 High 8.8 Dolibarr: SQL Injection in societe/class/societe.class.php via localtax1_value parameter 0.5%
• CVE-2026-118754 Medium 5.3 Dolibarr ERP CRM before 24.0.2 Missing Authorization via public recruitment view.php 0.2%
• CVE-2026-116219 High 7.2 Dolibarr ERP CRM before 24.0.0 OS Command Injection via mysqldump Parameter 2.1%
• CVE-2026-116218 High 7.6 Dolibarr ERP CRM 19.0.0 before 23.0.4 SQL Injection via bankaccounts API type field 0.3%
• CVE-2026-110874 Medium 6.6 Dolibarr before 23.0.4 PHP Object Injection via jsonOrUnserialize() 0.5%
• CVE-2026-107706 Medium 4.3 Dolibarr before 24.0.2 Incorrect Authorization via updateextrafield.php 0.2%
• CVE-2026-89013 High 7.5 Dolibarr 23.0.4 < 24.0.1 Authorization Bypass via hashp Parameter in document.php 1.6%
• CVE-2026-89012 Medium 6.5 Dolibarr 24.0.0 < 24.0.1 SQL Filter Denylist Bypass via sqlfilters Parameter 0.5%
• CVE-2026-82633 Medium 4.3 Dolibarr 10.0.0 before 24.0.0 Missing Authorization on REST Users Groups Endpoint 0.3%
• CVE-2026-81730 High 8.2 Dolibarr 9.0.0 through 23.0.4 Path Traversal via EmailCollector Attachment Filename 0.6%
• CVE-2026-81729 Medium 6.5 Dolibarr before 23.0.4 Incorrect Authorization on REST API Document Deletion 0.4%
• CVE-2026-81728 High 8.1 Dolibarr before 24.0.0 SQL Injection via the CSV and XLSX Import Update Keys 0.4%
• CVE-2026-77923 Medium 4.3 Dolibarr 21.0.0 < 24.0.0 Authorization Bypass via clonetasks Mass Action 0.4%
• CVE-2026-71511 Medium 6.5 Dolibarr < 24.0.0 Members REST API Sensitive Data Exposure via Member Endpoints 0.4%
• CVE-2026-71510 Medium 6.5 Dolibarr < 24.0.0 Users REST API SQL Injection via filter parameter 0.4%
• CVE-2026-71509 Medium 6.5 Dolibarr < 24.0.0 Expense Report REST API Improper Authorization via Update Endpoint 0.4%
• CVE-2026-71508 Medium 6.5 Dolibarr < 24.0.0 REST API Improper Authorization via User Update Endpoint 0.4%
• CVE-2026-71507 Medium 6.5 Dolibarr < 24.0.0 REST API Broken Object-Level Authorization via Bank Account Routes 0.4%
• CVE-2026-71506 High 8.1 Dolibarr < 24.0.0 Payments REST API Improper Authorization via Delete Endpoint 0.5%
• CVE-2026-71505 High 7.1 Dolibarr < 24.0.0 REST API Broken Object-Level Authorization via Third-Party Write Route 0.4%
• CVE-2026-71504 High 8.1 Dolibarr < 24.0.0 Members REST API Improper Authorization via Password Reset 0.5%
• CVE-2026-71503 Medium 6.1 Dolibarr < 24.0.0 Reflected XSS via Extra Fields Administration Template 0.4%
• CVE-2026-78160 Medium 6.3 Dolibarr ERP User Notes note.php authorization 0.4%
• CVE-2026-19350 Medium 6.3 Dolibarr ERP TakePOS invoice.php fail authorization 0.3%
• CVE-2026-58376 High 7.6 Dolibarr - SQL Injection via sqlfilters Parameter in Multiple REST API List Endpoints 0.4%
• CVE-2026-11619 Medium 6.3 Dolibarr ERP CRM Legacy Filemanager config.inc.php improper authorization 0.2%
• CVE-2026-10215 Medium 4.3 Dolibarr ERP CRM Leave Request REST API api_holidays.class.php checkUserAccessToObject improper authorization 0.3%
• CVE-2026-10154 Medium 4.3 Dolibarr ERP CRM messaging.php authorization 0.2%
• CVE-2025-67486 High 8.6 Dolibarr has an Authenticated Remote Code Execution via eval() injection in user extrafields 0.9%
• CVE-2026-7689 Low 3.7 Dolibarr ERP CRM Online Signature security.lib.php dol_verifyHash signature verification 0.1%