Skip to main content
cve.nowby Sazabi
← Packagist
PackagistPackage

dolibarr/dolibarr

126 known vulnerabilities (9 critical, 17 high, 15 medium, 1 low), with the versions each affects and the releases that fix them.

Latest release
Not known: cve.now hasn't read this package's releases
Newest unaffected release
Not known without release data
Advisories
126 · 9 critical, 17 high, 15 medium, 1 low
Registry
Packagist

Advisories 126

  • Dolibarr: SQL Injection in societe/class/societe.class.php via localtax1_value parameter

    Affected: fixed in 22.0.5; from 23.0.0, fixed in 23.0.2.

  • CVE-2026-10215Medium 5.3

    Dolibarr ERP CRM Leave Request REST API api_holidays.class.php checkUserAccessToObject improper authorization

    Affected: through 15.0.3.

  • CVE-2018-25357Critical 9.3

    Dolibarr ERP CRM 7.0.3 Remote Code Execution via install/step1.php

    Affected: from 7.0.0, fixed in 7.0.4; fixed in 6.0.8.

  • CVE-2026-7689Medium 6.3

    Dolibarr ERP CRM Online Signature security.lib.php dol_verifyHash signature verification

    Affected: through 15.0.3.

  • Dolibarr ERP CRM Shipments API Endpoint expedition.class.php _checkValForAPI sql injection

    Affected: through 23.0.2.

  • In the Website module of Dolibarr ERP & CRM 22.0.4 and below, the application uses blacklist-based filtering to restrict dangerous PHP…

    Affected: through 22.0.4.

  • In Dolibarr ERP & CRM <= 22.0.4, PHP code detection and editing permission enforcement in the Website module is not applied consistently…

    Affected: through 15.0.3.

  • CVE-2026-23500Critical 9.4

    Dolibarr: OS Command Injection (RCE) via MAIN_ODT_AS_PDF configuration

    Affected: through 22.0.4.

  • Dolibarr ERP-CRM 8.0.4 SQL Injection via rowid Parameter

    Affected: through 8.0.4.

  • CVE-2026-34036Medium 6.5

    Dolibarr Core Discloses Sensitive Data via Authenticated Local File Inclusion in selectobject.php

    Affected: fixed in 23.0.0.

  • Dolibarr ERP & CRM v21.0.1 were discovered to contain a remote code execution (RCE) vulnerability in the User module configuration via the…

    Affected: fixed in 21.0.3.

  • CVE-2024-55228Critical 9.0

    A cross-site scripting (XSS) vulnerability in the Product module of Dolibarr v21.0.0-beta allows attackers to execute arbitrary web…

    Affected: versions 21.0.0-beta.

  • CVE-2024-55227Critical 9.0

    A cross-site scripting (XSS) vulnerability in the Events/Agenda module of Dolibarr v21.0.0-beta allows attackers to execute arbitrary web…

    Affected: versions 21.0.0-beta.

  • CVE-2021-3991Medium 4.3

    Improper Authorization in dolibarr/dolibarr

    Affected: fixed in 15.0.0.

  • CVE-2024-40137Medium 5.5

    Dolibarr ERP CRM before 19.0.2-php8.2 was discovered to contain a remote code execution (RCE) vulnerability via the Computed field…

    Affected: fixed in 19.0.2.

Show all 126 advisoriesShow fewer advisories

  • An arbitrary file upload vulnerability in the Upload Template function of Dolibarr ERP CRM up to v19.0.1 allows attackers to execute…

    Affected: fixed in 19.0.2.

  • CVE-2024-34051Medium 4.6

    A Reflected Cross-site scripting (XSS) vulnerability located in htdocs/compta/paiement/card.php of Dolibarr before 19.0.2 allows remote…

    Affected: fixed in 19.0.2.

  • CVE-2024-5315Critical 9.1

    Multiple vulnerabilities in DOLIBARR's ERP CMS

    Affected: through 9.0.1.

  • CVE-2024-5314Critical 9.1

    Multiple vulnerabilities in DOLIBARR's ERP CMS

    Affected: through 9.0.1.

  • Incorrect access control in Dolibarr ERP CRM versions 19.0.0 and before, allows authenticated attackers to steal victim users' session…

    Affected: through 19.0.0.

  • Lack of sanitization during Installation Process in Dolibarr ERP CRM up to version 19.0.0 allows an attacker with adjacent access to the…

    Affected: through 19.0.0.

  • Dolibarr Application Home Page HTML injection vulnerability

    Affected: from 18.0.4, fixed in 18.0.7.

  • CVE-2023-4198Medium 6.5

    Dolibarr ERP CRM (<= 17.0.3) Improper Access Control

    Affected: fixed in 18.0.0.

  • Dolibarr ERP CRM (<= 18.0.1) Improper Input Sanitization Authenticated RCE

    Affected: fixed in 18.0.2.

  • CVE-2023-5842Medium 4.8

    Cross-site Scripting (XSS) - Stored in dolibarr/dolibarr

    Affected: fixed in 16.0.5.

  • CVE-2023-5323Medium 5.4

    Cross-site Scripting (XSS) - Generic in dolibarr/dolibarr

    Affected: fixed in 18.0.0.

  • Cross Site Scripting vulnerability in Dolibarr ERP CRM v.17.0.1 and before allows a remote attacker to obtain sensitive information and…

    Affected: fixed in 17.0.1.

  • File Upload vulnerability in Dolibarr ERP CRM v.17.0.1 and before allows a remote attacker to execute arbitrary code and obtain sensitive…

    Affected: fixed in 17.0.1.

  • An issue in Dolibarr ERP CRM v.17.0.1 and before allows a remote privileged attacker to execute arbitrary code via a crafted command/script.

    Affected: fixed in 17.0.1.

  • An issue in Dolibarr 16 before 16.0.5 allows unauthenticated attackers to perform a database dump and access a company's entire customer…

    Affected: from 16.0.0, fixed in 16.0.5.

  • Dolibarr before 17.0.1 allows remote code execution by an authenticated user via an uppercase manipulation: <?PHP instead of <?php in…

    Affected: fixed in 17.0.1.

  • SQL Injection in dolibarr/dolibarr

    Affected: from 16.0.1, fixed in 16.0.3.

  • CVE-2022-43138Critical 9.8

    Dolibarr Open Source ERP & CRM for Business before v14.0.1 allows attackers to escalate privileges via a crafted API.

    Affected: fixed in 14.0.1.

  • CVE-2022-40871Critical 9.8

    Dolibarr ERP & CRM <=15.0.3 is vulnerable to Eval injection.

    Affected: through 15.0.3.

  • Cross-site Scripting (XSS) - Stored in dolibarr/dolibarr

    Affected: fixed in 16.0.

  • Dolibarr 12.0.5 is vulnerable to Cross Site Scripting (XSS) via Sql Error Page.

    Affected: versions 12.0.5.

  • An Access Control vulnerability exists in Dolibarr ERP/CRM 13.0.2, fixed version is 14.0.0,in the forgot-password function becuase the…

    Affected: fixed in 14.0.1.

  • An SQL Injection vulnerability exists in Dolibarr ERP/CRM 13.0.2 (fixed version is 14.0.0) via a POST request to the country_id parameter…

    Affected: fixed in 14.0.0.

  • Code Injection in dolibarr/dolibarr

    Affected: fixed in 15.0.1.

  • CVE-2022-0746Medium 4.3

    Business Logic Errors in dolibarr/dolibarr

    Affected: fixed in 16.0.

  • CVE-2022-0731Medium 5.4

    Improper Access Control (IDOR) in dolibarr/dolibarr

    Affected: fixed in 16.0.

  • CVE-2022-0414Medium 4.1

    Improper Validation of Specified Quantity in Input in dolibarr/dolibarr

    Affected: fixed in 15.0.

  • SQL Injection in dolibarr/dolibarr

    Affected: through 14.0.5.

  • CVE-2022-0174Medium 4.3

    Improper Validation of Specified Quantity in Input in dolibarr/dolibarr

    Affected: fixed in 15.0.0.

  • admin/limits.php in Dolibarr 7.0.2 allows HTML injection, as demonstrated by the MAIN_MAX_DECIMALS_TOT parameter.

    Affected: fixed in 13.0.0.

  • A Cross Site Scripting (XSS) vulnerability exists in Dolibarr before 14.0.3 via the ticket creation flow.

    Affected: fixed in 14.0.3.

  • Dolibarr ERP and CRM 13.0.2 allows XSS via object details, as demonstrated by > and < characters in the onpointermove attribute of a BODY…

    Affected: through 13.0.2.

  • The website builder module in Dolibarr 13.0.2 allows remote PHP code execution because of an incomplete protection mechanism in which…

    Affected: from 13.0.2, fixed in 14.0.0.

  • CVE-2021-25956Medium 4.7

    Improper User Access Control in "Dolibarr" Leads to Account Takeover

    Affected: from 3.3.beta1, fixed in 14.0.0.

  • Account Takeover in "Dolibarr" via Password Reset Functionality

    Affected: fixed in 14.0.0.

  • CVE-2021-25955Critical 9.0

    Stored XSS in “Dolibarr” leads to privilege escalation

    Affected: from 2.8.1, fixed in 14.0.0.

  • CVE-2021-25954Medium 4.3

    Improper Access Control in “Dolibarr”

    Affected: from 2.8.1, fixed in 14.0.0.

  • Dolibarr 12.0.3 is vulnerable to authenticated Remote Code Execution.

    Affected: fixed in 12.0.4.

  • Dolibarr before 11.0.5 allows low-privilege users to upload files of dangerous types, leading to arbitrary code execution.

    Affected: fixed in 11.0.5.

  • Dolibarr 11.0.4 is affected by multiple stored Cross-Site Scripting (XSS) vulnerabilities that could allow remote authenticated attackers…

    Affected: through 11.0.4.

  • Dolibarr CRM before 11.0.5 allows privilege escalation.

    Affected: fixed in 11.0.5.

  • A reflected cross-site scripting (XSS) vulnerability in Dolibarr 11.0.3 allows remote attackers to inject arbitrary web script or HTML…

    Affected: fixed in 11.0.5.

  • A SQL injection vulnerability in accountancy/customer/card.php in Dolibarr 11.0.3 allows remote authenticated users to execute arbitrary…

    Affected: fixed in 11.0.5.

  • The DMS/ECM module in Dolibarr 11.0.4 renders user-uploaded .html files in the browser when the attachment parameter is removed from the…

    Affected: versions 11.0.4.

  • The DMS/ECM module in Dolibarr 11.0.4 allows users with the 'Setup documents directories' permission to rename uploaded files to have…

    Affected: versions 11.0.4.

  • Dolibarr before 11.0.4 allows XSS.

    Affected: fixed in 11.0.4.

  • core/get_menudiv.php in Dolibarr before 11.0.4 allows remote authenticated attackers to bypass intended access restrictions via a…

    Affected: fixed in 12.0.0.

  • In Dolibarr 10.0.6, forms are protected with a CSRF token against CSRF attacks.

    Affected: through 10.0.6.

  • In Dolibarr 10.0.6, if USER_LOGIN_FAILED is active, there is a stored XSS vulnerability on the admin tools --> audit page.

    Affected: versions 10.0.6.

  • Dolibarr ERP/CRM 3.0 through 10.0.3 allows XSS via the qty parameter to product/fournisseurs.php (product price screen).

    Affected: from 3.0, through 10.0.3.

  • Dolibarr ERP/CRM before 10.0.3 has an Insufficient Filtering issue that can lead to user/card.php XSS.

    Affected: fixed in 10.0.3.

  • Dolibarr ERP/CRM before 10.0.3 allows XSS because uploaded HTML documents are served as text/html despite being renamed to .noexe files.

    Affected: fixed in 10.0.3.

  • Dolibarr ERP/CRM before 10.0.3 allows SQL Injection.

    Affected: fixed in 10.0.3.

  • Dolibarr 11.0 allows XSS via the joinfiles, topic, or code parameter, or the HTTP Referer header.

    Affected: through 11.0.0.

  • Multiple cross-site scripting (XSS) vulnerabilities in Dolibarr 10.0.6 allow remote attackers to inject arbitrary web script or HTML via…

    Affected: versions 10.0.6.

  • The htdocs/index.php?mainmenu=home login page in Dolibarr 10.0.6 allows an unlimited rate of failed authentication attempts.

    Affected: versions 10.0.6.

  • htdocs/user/passwordforgotten.php in Dolibarr 10.0.6 allows XSS via the Referer HTTP header.

    Affected: through 10.0.6.

  • Dolibarr CRM/ERP 10.0.3 allows viewimage.php?file= Stored XSS due to JavaScript execution in an SVG image for a profile picture.

    Affected: through 10.0.3.

  • An issue was discovered in Dolibarr 10.0.2.

    Affected: versions 10.0.2.

  • An issue was discovered in Dolibarr 10.0.2.

    Affected: versions 10.0.2.

  • An issue was discovered in Dolibarr 10.0.2.

    Affected: versions 10.0.2.

  • There is HTML Injection in the Note field in Dolibarr ERP/CRM 10.0.2 via user/note.php.

    Affected: fixed in 11.0.1.

  • Dolibarr 9.0.5 has stored XSS in an Email Template section to mails_templates.php.

    Affected: versions 9.0.5.

  • Dolibarr 9.0.5 has stored XSS in a User Profile in a Signature section to card.php.

    Affected: versions 9.0.5.

  • Dolibarr 9.0.5 has stored XSS in a User Note section to note.php.

    Affected: versions 9.0.5.

  • Dolibarr 9.0.5 has stored XSS vulnerability via a User Group Description section to card.php.

    Affected: versions 9.0.5.

  • In htdocs/societe/card.php in Dolibarr 10.0.1, the value of the User-Agent HTTP header is copied into the HTML document as plain text…

    Affected: fixed in 10.0.2.

  • An issue was discovered in Dolibarr 11.0.0-alpha.

    Affected: from 10.0, fixed in 10.0.2.

  • Dolibarr ERP/CRM 9.0.1 provides a module named website that provides for creation of public websites with a WYSIWYG editor.

    Affected: fixed in 9.0.3.

  • Dolibarr ERP/CRM 9.0.1 provides a web-based functionality that backs up the database content to a dump file.

    Affected: fixed in 9.0.3.

  • Dolibarr 7.0.0 is affected by: Cross Site Request Forgery (CSRF).

    Affected: versions 7.0.0.

  • Dolibarr 6.0.4 is affected by: Cross Site Scripting (XSS).

    Affected: versions 6.0.4.

  • An issue was discovered in Dolibarr through 7.0.0.

    Affected: from 3.8, through 7.0.0.

  • An issue was discovered in Dolibarr through 7.0.0.

    Affected: fixed in 7.0.1.

  • SQL injection vulnerability in user/card.php in Dolibarr version 8.0.2 allows remote authenticated users to execute arbitrary SQL commands…

    Affected: fixed in 8.0.4.

  • A stored cross-site scripting (XSS) vulnerability in Dolibarr 8.0.2 allows remote authenticated users to inject arbitrary web script or…

    Affected: fixed in 8.0.4.

  • An error-based SQL injection vulnerability in product/card.php in Dolibarr version 8.0.2 allows remote authenticated users to execute…

    Affected: fixed in 8.0.4.

  • A reflected cross-site scripting (XSS) vulnerability in Dolibarr 8.0.2 allows remote attackers to inject arbitrary web script or HTML via…

    Affected: fixed in 8.0.4.

  • A stored cross-site scripting (XSS) vulnerability in Dolibarr 8.0.2 allows remote authenticated users to inject arbitrary web script or…

    Affected: fixed in 8.0.4.

  • Dolibarr ERP/CRM through 8.0.3 has /exports/export.php?datatoexport= XSS.

    Affected: through 8.0.3.

  • SQL injection vulnerability in product/card.php in Dolibarr ERP/CRM version 7.0.3 allows remote attackers to execute arbitrary SQL…

    Affected: from 7.0.3, fixed in 7.0.4.

  • SQL injection vulnerability in product/card.php in Dolibarr ERP/CRM version 7.0.3 allows remote attackers to execute arbitrary SQL…

    Affected: from 7.0.3, fixed in 7.0.4.

  • SQL injection vulnerability in product/card.php in Dolibarr ERP/CRM version 7.0.3 allows remote attackers to execute arbitrary SQL…

    Affected: from 7.0.3, fixed in 7.0.4.

  • SQL injection vulnerability in product/card.php in Dolibarr ERP/CRM version 7.0.3 allows remote attackers to execute arbitrary SQL…

    Affected: from 7.0.3, fixed in 7.0.4.

  • SQL Injection vulnerability in Dolibarr before version 7.0.2 allows remote attackers to execute arbitrary SQL commands via the sortfield…

    Affected: fixed in 7.0.2.

  • Cross-site scripting (XSS) vulnerability in Dolibarr before 7.0.2 allows remote attackers to inject arbitrary web script or HTML via the…

    Affected: fixed in 7.0.2.

  • SQL injection vulnerability in Dolibarr before 7.0.2 allows remote attackers to execute arbitrary SQL commands via vectors involving…

    Affected: fixed in 7.0.2.

  • The admin panel in Dolibarr before 7.0.2 might allow remote attackers to execute arbitrary commands by leveraging support for updating the…

    Affected: fixed in 7.0.2.

  • Dolibarr ERP/CRM is affected by SQL injection in versions before 5.0.4 via product/stats/card.php (type parameter).

    Affected: fixed in 5.0.4.

  • Dolibarr ERP/CRM is affected by multiple reflected Cross-Site Scripting (XSS) vulnerabilities in versions before 5.0.4: index.php…

    Affected: fixed in 5.0.4.

  • Dolibarr ERP/CRM is affected by multiple SQL injection vulnerabilities in versions through 7.0.0 via comm/propal/list.php (viewstatut…

    Affected: through 7.0.0.

  • Dolibarr ERP/CRM is affected by stored Cross-Site Scripting (XSS) in versions through 7.0.0.

    Affected: through 7.0.0.

  • Dolibarr version 6.0.2 contains a Cross Site Scripting (XSS) vulnerability in Product details that can result in execution of javascript…

    Affected: fixed in 7.0.0.

  • The test_sql_and_script_inject function in htdocs/main.inc.php in Dolibarr ERP/CRM 6.0.4 blocks some event attributes but neither onclick…

    Affected: fixed in 6.0.5.

  • SQL injection vulnerability in fourn/index.php in Dolibarr ERP/CRM version 6.0.4 allows remote attackers to execute arbitrary SQL commands…

    Affected: fixed in 6.0.5.

  • SQL injection vulnerability in adherents/subscription/info.php in Dolibarr ERP/CRM version 6.0.4 allows remote attackers to execute…

    Affected: fixed in 6.0.5.

  • Dolibarr ERP/CRM version 6.0.4 does not block direct requests to *.tpl.php files, which allows remote attackers to obtain sensitive…

    Affected: fixed in 6.0.5.

  • SQL injection vulnerability in comm/multiprix.php in Dolibarr ERP/CRM version 6.0.4 allows remote attackers to execute arbitrary SQL…

    Affected: fixed in 6.0.5.

  • SQL injection vulnerability in don/list.php in Dolibarr version 6.0.0 allows remote attackers to execute arbitrary SQL commands via the…

    Affected: fixed in 6.0.1.

  • Cross-site scripting (XSS) vulnerability in Dolibarr ERP/CRM 6.0.0 allows remote authenticated users to inject arbitrary web script or…

    Affected: fixed in 6.0.1.

  • There is a sensitive information disclosure vulnerability in document.php in Dolibarr ERP/CRM version 6.0.0 via the file parameter.

    Affected: fixed in 6.0.1.

  • Multiple cross-site scripting (XSS) vulnerabilities in Dolibarr ERP/CRM 6.0.0 allow remote authenticated users to inject arbitrary web…

    Affected: from 6.0.0, fixed in 6.0.1.

  • SQL injection vulnerability in admin/menus/edit.php in Dolibarr ERP/CRM version 6.0.0 allows remote attackers to execute arbitrary SQL…

    Affected: fixed in 6.0.1.

  • Dolibarr ERP/CRM 5.0.3 and prior allows low-privilege users to upload files of dangerous types, which can result in arbitrary code…

    Affected: through 5.0.3.

  • Dolibarr ERP/CRM before 5.0.3 is vulnerable to a SQL injection in user/index.php (search_supervisor and search_statut parameters).

    Affected: fixed in 5.0.3.

  • Dolibarr ERP/CRM 4.0.4 allows password changes without supplying the current password, which makes it easier for physically proximate…

    Affected: versions 4.0.4.

  • Dolibarr ERP/CRM 4.0.4 stores passwords with the MD5 algorithm, which makes brute-force attacks easier.

    Affected: through 4.0.4.

  • Dolibarr ERP/CRM 4.0.4 has XSS in doli/societe/list.php via the sall parameter.

    Affected: through 4.0.4.

  • Dolibarr ERP/CRM 4.0.4 has SQL Injection in doli/theme/eldy/style.css.php via the lang parameter.

    Affected: versions 4.0.4.

  • Multiple cross-site scripting (XSS) vulnerabilities in Dolibarr ERP/CRM 3.8.3 allow remote authenticated users to inject arbitrary web…

    Affected: through 3.8.3.

  • Multiple cross-site scripting (XSS) vulnerabilities in Dolibarr ERP/CRM 3.5 and 3.6 allow remote attackers to inject arbitrary web script…

    Affected: from 3.5.0, fixed in 3.5.8.