Dolibarr Dolibarr

• CVE-2026-33944 High 8.8 Dolibarr: SQL Injection in societe/class/societe.class.php via localtax1_value parameter 0.5%
• CVE-2026-116219 High 7.2 Dolibarr ERP CRM before 24.0.0 OS Command Injection via mysqldump Parameter 2.1%
• CVE-2026-116218 High 7.6 Dolibarr ERP CRM 19.0.0 before 23.0.4 SQL Injection via bankaccounts API type field 0.3%
• CVE-2026-110874 Medium 6.6 Dolibarr before 23.0.4 PHP Object Injection via jsonOrUnserialize() 0.5%
• CVE-2026-107706 Medium 4.3 Dolibarr before 24.0.2 Incorrect Authorization via updateextrafield.php 0.2%
• CVE-2026-89013 High 7.5 Dolibarr 23.0.4 < 24.0.1 Authorization Bypass via hashp Parameter in document.php 1.6%
• CVE-2026-89012 Medium 6.5 Dolibarr 24.0.0 < 24.0.1 SQL Filter Denylist Bypass via sqlfilters Parameter 0.5%
• CVE-2026-82633 Medium 4.3 Dolibarr 10.0.0 before 24.0.0 Missing Authorization on REST Users Groups Endpoint 0.3%
• CVE-2026-81730 High 8.2 Dolibarr 9.0.0 through 23.0.4 Path Traversal via EmailCollector Attachment Filename 0.6%
• CVE-2026-81729 Medium 6.5 Dolibarr before 23.0.4 Incorrect Authorization on REST API Document Deletion 0.4%
• CVE-2026-81728 High 8.1 Dolibarr before 24.0.0 SQL Injection via the CSV and XLSX Import Update Keys 0.4%
• CVE-2026-77923 Medium 4.3 Dolibarr 21.0.0 < 24.0.0 Authorization Bypass via clonetasks Mass Action 0.4%
• CVE-2026-71511 Medium 6.5 Dolibarr < 24.0.0 Members REST API Sensitive Data Exposure via Member Endpoints 0.4%
• CVE-2026-71510 Medium 6.5 Dolibarr < 24.0.0 Users REST API SQL Injection via filter parameter 0.4%
• CVE-2026-71509 Medium 6.5 Dolibarr < 24.0.0 Expense Report REST API Improper Authorization via Update Endpoint 0.4%
• CVE-2026-71508 Medium 6.5 Dolibarr < 24.0.0 REST API Improper Authorization via User Update Endpoint 0.4%
• CVE-2026-71507 Medium 6.5 Dolibarr < 24.0.0 REST API Broken Object-Level Authorization via Bank Account Routes 0.4%
• CVE-2026-71506 High 8.1 Dolibarr < 24.0.0 Payments REST API Improper Authorization via Delete Endpoint 0.5%
• CVE-2026-71505 High 7.1 Dolibarr < 24.0.0 REST API Broken Object-Level Authorization via Third-Party Write Route 0.4%
• CVE-2026-71504 High 8.1 Dolibarr < 24.0.0 Members REST API Improper Authorization via Password Reset 0.5%
• CVE-2026-71503 Medium 6.1 Dolibarr < 24.0.0 Reflected XSS via Extra Fields Administration Template 0.4%
• CVE-2026-58376 High 7.6 Dolibarr - SQL Injection via sqlfilters Parameter in Multiple REST API List Endpoints 0.4%
• CVE-2025-67486 High 8.6 Dolibarr has an Authenticated Remote Code Execution via eval() injection in user extrafields 0.9%
• CVE-2026-23500 Critical 9.4 Dolibarr: OS Command Injection (RCE) via MAIN_ODT_AS_PDF configuration 0.9%
• CVE-2026-34036 Medium 6.5 Dolibarr Core Discloses Sensitive Data via Authenticated Local File Inclusion in selectobject.php 1.5%
• CVE-2020-36966 Medium 6.4 Dolibarr 11.0.3 - 'ldap.php' - Persistent Cross-Site Scripting 0.3%
• CVE-2024-23817 High 7.1 Dolibarr Application Home Page HTML injection vulnerability 0.6%
• CVE-2021-25956 Medium 4.7 Improper User Access Control in "Dolibarr" Leads to Account Takeover 0.9%
• CVE-2021-25957 High 8.8 Account Takeover in "Dolibarr" via Password Reset Functionality 1.1%
• CVE-2021-25955 Critical 9.0 Stored XSS in “Dolibarr” leads to privilege escalation 0.9%
• CVE-2021-25954 Medium 4.3 Improper Access Control in “Dolibarr” 0.7%