# dolibarr/dolibarr (Packagist) vulnerabilities 126 known vulnerabilities (9 critical, 17 high, 15 medium, 1 low), with the versions each affects and the releases that fix them. ## At a glance - Latest release: not known (cve.now hasn't read this package's releases) - Newest unaffected release: not known without release data - Registry: https://packagist.org/packages/dolibarr/dolibarr ## Advisories (126) ### [CVE-2026-33944](https://cve.now/CVE-2026-33944): Dolibarr: SQL Injection in societe/class/societe.class.php via localtax1\_value parameter - Severity: High 8.8 - Published: Nov 5, 2026 - Affected: fixed in 22.0.5; from 23.0.0, fixed in 23.0.2. ### [CVE-2026-10215](https://cve.now/CVE-2026-10215): Dolibarr ERP CRM Leave Request REST API api\_holidays.class.php checkUserAccessToObject improper authorization - Severity: Medium 5.3 - Published: Jun 1, 2026 - Affected: through 15.0.3. ### [CVE-2018-25357](https://cve.now/CVE-2018-25357): Dolibarr ERP CRM 7.0.3 Remote Code Execution via install/step1.php - Severity: Critical 9.3 - Published: May 23, 2026 - Affected: from 7.0.0, fixed in 7.0.4; fixed in 6.0.8. ### [CVE-2026-7689](https://cve.now/CVE-2026-7689): Dolibarr ERP CRM Online Signature security.lib.php dol\_verifyHash signature verification - Severity: Medium 6.3 - Published: May 3, 2026 - Affected: through 15.0.3. ### [CVE-2026-7688](https://cve.now/CVE-2026-7688): Dolibarr ERP CRM Shipments API Endpoint expedition.class.php \_checkValForAPI sql injection - Severity: Low 2.3 - Published: May 3, 2026 - Affected: through 23.0.2. ### [CVE-2026-31019](https://cve.now/CVE-2026-31019): In the Website module of Dolibarr ERP & CRM 22.0.4 and below, the application uses blacklist-based filtering to restrict dangerous PHP… - Severity: High 8.8 - Published: Apr 21, 2026 - Affected: through 22.0.4. ### [CVE-2026-31018](https://cve.now/CVE-2026-31018): In Dolibarr ERP & CRM \<= 22.0.4, PHP code detection and editing permission enforcement in the Website module is not applied consistently… - Severity: High 8.8 - Published: Apr 21, 2026 - Affected: through 15.0.3. ### [CVE-2026-23500](https://cve.now/CVE-2026-23500): Dolibarr: OS Command Injection (RCE) via MAIN\_ODT\_AS\_PDF configuration - Severity: Critical 9.4 - Published: Apr 17, 2026 - Affected: through 22.0.4. ### [CVE-2019-25710](https://cve.now/CVE-2019-25710): Dolibarr ERP-CRM 8.0.4 SQL Injection via rowid Parameter - Severity: High 8.8 - Published: Apr 12, 2026 - Affected: through 8.0.4. ### [CVE-2026-34036](https://cve.now/CVE-2026-34036): Dolibarr Core Discloses Sensitive Data via Authenticated Local File Inclusion in selectobject.php - Severity: Medium 6.5 - Published: Mar 31, 2026 - Affected: fixed in 23.0.0. ### [CVE-2025-56588](https://cve.now/CVE-2025-56588): Dolibarr ERP & CRM v21.0.1 were discovered to contain a remote code execution (RCE) vulnerability in the User module configuration via the… - Severity: High 8.8 - Published: Oct 1, 2025 - Affected: fixed in 21.0.3. ### [CVE-2024-55228](https://cve.now/CVE-2024-55228): A cross-site scripting (XSS) vulnerability in the Product module of Dolibarr v21.0.0-beta allows attackers to execute arbitrary web… - Severity: Critical 9.0 - Published: Jan 27, 2025 - Affected: versions 21.0.0-beta. ### [CVE-2024-55227](https://cve.now/CVE-2024-55227): A cross-site scripting (XSS) vulnerability in the Events/Agenda module of Dolibarr v21.0.0-beta allows attackers to execute arbitrary web… - Severity: Critical 9.0 - Published: Jan 27, 2025 - Affected: versions 21.0.0-beta. ### [CVE-2021-3991](https://cve.now/CVE-2021-3991): Improper Authorization in dolibarr/dolibarr - Severity: Medium 4.3 - Published: Nov 15, 2024 - Affected: fixed in 15.0.0. ### [CVE-2024-40137](https://cve.now/CVE-2024-40137): Dolibarr ERP CRM before 19.0.2-php8.2 was discovered to contain a remote code execution (RCE) vulnerability via the Computed field… - Severity: Medium 5.5 - Published: Jul 24, 2024 - Affected: fixed in 19.0.2. ### [CVE-2024-37821](https://cve.now/CVE-2024-37821): An arbitrary file upload vulnerability in the Upload Template function of Dolibarr ERP CRM up to v19.0.1 allows attackers to execute… - Severity: High 8.8 - Published: Jun 18, 2024 - Affected: fixed in 19.0.2. ### [CVE-2024-34051](https://cve.now/CVE-2024-34051): A Reflected Cross-site scripting (XSS) vulnerability located in htdocs/compta/paiement/card.php of Dolibarr before 19.0.2 allows remote… - Severity: Medium 4.6 - Published: Jun 3, 2024 - Affected: fixed in 19.0.2. ### [CVE-2024-5315](https://cve.now/CVE-2024-5315): Multiple vulnerabilities in DOLIBARR's ERP CMS - Severity: Critical 9.1 - Published: May 24, 2024 - Affected: through 9.0.1. ### [CVE-2024-5314](https://cve.now/CVE-2024-5314): Multiple vulnerabilities in DOLIBARR's ERP CMS - Severity: Critical 9.1 - Published: May 24, 2024 - Affected: through 9.0.1. ### [CVE-2024-31503](https://cve.now/CVE-2024-31503): Incorrect access control in Dolibarr ERP CRM versions 19.0.0 and before, allows authenticated attackers to steal victim users' session… - Severity: High 7.5 - Published: Apr 16, 2024 - Affected: through 19.0.0. ### [CVE-2024-29477](https://cve.now/CVE-2024-29477): Lack of sanitization during Installation Process in Dolibarr ERP CRM up to version 19.0.0 allows an attacker with adjacent access to the… - Severity: High 8.8 - Published: Apr 3, 2024 - Affected: through 19.0.0. ### [CVE-2024-23817](https://cve.now/CVE-2024-23817): Dolibarr Application Home Page HTML injection vulnerability - Severity: High 7.1 - Published: Jan 25, 2024 - Affected: from 18.0.4, fixed in 18.0.7. ### [CVE-2023-4198](https://cve.now/CVE-2023-4198): Dolibarr ERP CRM (\<= 17.0.3) Improper Access Control - Severity: Medium 6.5 - Published: Nov 1, 2023 - Affected: fixed in 18.0.0. ### [CVE-2023-4197](https://cve.now/CVE-2023-4197): Dolibarr ERP CRM (\<= 18.0.1) Improper Input Sanitization Authenticated RCE - Severity: High 7.5 - Published: Nov 1, 2023 - Affected: fixed in 18.0.2. ### [CVE-2023-5842](https://cve.now/CVE-2023-5842): Cross-site Scripting (XSS) - Stored in dolibarr/dolibarr - Severity: Medium 4.8 - Published: Oct 30, 2023 - Affected: fixed in 16.0.5. ### [CVE-2023-5323](https://cve.now/CVE-2023-5323): Cross-site Scripting (XSS) - Generic in dolibarr/dolibarr - Severity: Medium 5.4 - Published: Oct 1, 2023 - Affected: fixed in 18.0.0. ### [CVE-2023-38888](https://cve.now/CVE-2023-38888): Cross Site Scripting vulnerability in Dolibarr ERP CRM v.17.0.1 and before allows a remote attacker to obtain sensitive information and… - Severity: Unrated - Published: Sep 20, 2023 - Affected: fixed in 17.0.1. ### [CVE-2023-38887](https://cve.now/CVE-2023-38887): File Upload vulnerability in Dolibarr ERP CRM v.17.0.1 and before allows a remote attacker to execute arbitrary code and obtain sensitive… - Severity: High 8.8 - Published: Sep 20, 2023 - Affected: fixed in 17.0.1. ### [CVE-2023-38886](https://cve.now/CVE-2023-38886): An issue in Dolibarr ERP CRM v.17.0.1 and before allows a remote privileged attacker to execute arbitrary code via a crafted command/script. - Severity: Unrated - Published: Sep 20, 2023 - Affected: fixed in 17.0.1. ### [CVE-2023-33568](https://cve.now/CVE-2023-33568): An issue in Dolibarr 16 before 16.0.5 allows unauthenticated attackers to perform a database dump and access a company's entire customer… - Severity: Unrated - Published: Jun 13, 2023 - Affected: from 16.0.0, fixed in 16.0.5. ### [CVE-2023-30253](https://cve.now/CVE-2023-30253): Dolibarr before 17.0.1 allows remote code execution by an authenticated user via an uppercase manipulation: \ and \< characters in the onpointermove attribute of a BODY… - Severity: Unrated - Published: Nov 10, 2021 - Affected: through 13.0.2. ### [CVE-2021-33816](https://cve.now/CVE-2021-33816): The website builder module in Dolibarr 13.0.2 allows remote PHP code execution because of an incomplete protection mechanism in which… - Severity: Unrated - Published: Nov 10, 2021 - Affected: from 13.0.2, fixed in 14.0.0. ### [CVE-2021-25956](https://cve.now/CVE-2021-25956): Improper User Access Control in "Dolibarr" Leads to Account Takeover - Severity: Medium 4.7 - Published: Aug 17, 2021 - Affected: from 3.3.beta1, fixed in 14.0.0. ### [CVE-2021-25957](https://cve.now/CVE-2021-25957): Account Takeover in "Dolibarr" via Password Reset Functionality - Severity: High 8.8 - Published: Aug 17, 2021 - Affected: fixed in 14.0.0. ### [CVE-2021-25955](https://cve.now/CVE-2021-25955): Stored XSS in “Dolibarr” leads to privilege escalation - Severity: Critical 9.0 - Published: Aug 15, 2021 - Affected: from 2.8.1, fixed in 14.0.0. ### [CVE-2021-25954](https://cve.now/CVE-2021-25954): Improper Access Control in “Dolibarr” - Severity: Medium 4.3 - Published: Aug 9, 2021 - Affected: from 2.8.1, fixed in 14.0.0. ### [CVE-2020-35136](https://cve.now/CVE-2020-35136): Dolibarr 12.0.3 is vulnerable to authenticated Remote Code Execution. - Severity: Unrated - Published: Dec 23, 2020 - Affected: fixed in 12.0.4. ### [CVE-2020-14209](https://cve.now/CVE-2020-14209): Dolibarr before 11.0.5 allows low-privilege users to upload files of dangerous types, leading to arbitrary code execution. - Severity: Unrated - Published: Sep 2, 2020 - Affected: fixed in 11.0.5. ### [CVE-2020-13828](https://cve.now/CVE-2020-13828): Dolibarr 11.0.4 is affected by multiple stored Cross-Site Scripting (XSS) vulnerabilities that could allow remote authenticated attackers… - Severity: Unrated - Published: Aug 31, 2020 - Affected: through 11.0.4. ### [CVE-2020-14201](https://cve.now/CVE-2020-14201): Dolibarr CRM before 11.0.5 allows privilege escalation. - Severity: Unrated - Published: Aug 21, 2020 - Affected: fixed in 11.0.5. ### [CVE-2020-14475](https://cve.now/CVE-2020-14475): A reflected cross-site scripting (XSS) vulnerability in Dolibarr 11.0.3 allows remote attackers to inject arbitrary web script or HTML… - Severity: Unrated - Published: Jun 19, 2020 - Affected: fixed in 11.0.5. ### [CVE-2020-14443](https://cve.now/CVE-2020-14443): A SQL injection vulnerability in accountancy/customer/card.php in Dolibarr 11.0.3 allows remote authenticated users to execute arbitrary… - Severity: Unrated - Published: Jun 18, 2020 - Affected: fixed in 11.0.5. ### [CVE-2020-13239](https://cve.now/CVE-2020-13239): The DMS/ECM module in Dolibarr 11.0.4 renders user-uploaded .html files in the browser when the attachment parameter is removed from the… - Severity: Unrated - Published: May 20, 2020 - Affected: versions 11.0.4. ### [CVE-2020-13240](https://cve.now/CVE-2020-13240): The DMS/ECM module in Dolibarr 11.0.4 allows users with the 'Setup documents directories' permission to rename uploaded files to have… - Severity: Unrated - Published: May 20, 2020 - Affected: versions 11.0.4. ### [CVE-2020-13094](https://cve.now/CVE-2020-13094): Dolibarr before 11.0.4 allows XSS. - Severity: Unrated - Published: May 18, 2020 - Affected: fixed in 11.0.4. ### [CVE-2020-12669](https://cve.now/CVE-2020-12669): core/get\_menudiv.php in Dolibarr before 11.0.4 allows remote authenticated attackers to bypass intended access restrictions via a… - Severity: Unrated - Published: May 6, 2020 - Affected: fixed in 12.0.0. ### [CVE-2020-11825](https://cve.now/CVE-2020-11825): In Dolibarr 10.0.6, forms are protected with a CSRF token against CSRF attacks. - Severity: Unrated - Published: Apr 16, 2020 - Affected: through 10.0.6. ### [CVE-2020-11823](https://cve.now/CVE-2020-11823): In Dolibarr 10.0.6, if USER\_LOGIN\_FAILED is active, there is a stored XSS vulnerability on the admin tools --\> audit page. - Severity: Unrated - Published: Apr 16, 2020 - Affected: versions 10.0.6. ### [CVE-2019-19212](https://cve.now/CVE-2019-19212): Dolibarr ERP/CRM 3.0 through 10.0.3 allows XSS via the qty parameter to product/fournisseurs.php (product price screen). - Severity: Unrated - Published: Mar 16, 2020 - Affected: from 3.0, through 10.0.3. ### [CVE-2019-19211](https://cve.now/CVE-2019-19211): Dolibarr ERP/CRM before 10.0.3 has an Insufficient Filtering issue that can lead to user/card.php XSS. - Severity: Unrated - Published: Mar 16, 2020 - Affected: fixed in 10.0.3. ### [CVE-2019-19210](https://cve.now/CVE-2019-19210): Dolibarr ERP/CRM before 10.0.3 allows XSS because uploaded HTML documents are served as text/html despite being renamed to .noexe files. - Severity: Unrated - Published: Mar 16, 2020 - Affected: fixed in 10.0.3. ### [CVE-2019-19209](https://cve.now/CVE-2019-19209): Dolibarr ERP/CRM before 10.0.3 allows SQL Injection. - Severity: Unrated - Published: Mar 16, 2020 - Affected: fixed in 10.0.3. ### [CVE-2020-9016](https://cve.now/CVE-2020-9016): Dolibarr 11.0 allows XSS via the joinfiles, topic, or code parameter, or the HTTP Referer header. - Severity: Unrated - Published: Feb 16, 2020 - Affected: through 11.0.0. ### [CVE-2020-7994](https://cve.now/CVE-2020-7994): Multiple cross-site scripting (XSS) vulnerabilities in Dolibarr 10.0.6 allow remote attackers to inject arbitrary web script or HTML via… - Severity: Unrated - Published: Jan 26, 2020 - Affected: versions 10.0.6. ### [CVE-2020-7995](https://cve.now/CVE-2020-7995): The htdocs/index.php?mainmenu=home login page in Dolibarr 10.0.6 allows an unlimited rate of failed authentication attempts. - Severity: Unrated - Published: Jan 26, 2020 - Affected: versions 10.0.6. ### [CVE-2020-7996](https://cve.now/CVE-2020-7996): htdocs/user/passwordforgotten.php in Dolibarr 10.0.6 allows XSS via the Referer HTTP header. - Severity: Unrated - Published: Jan 26, 2020 - Affected: through 10.0.6. ### [CVE-2019-19206](https://cve.now/CVE-2019-19206): Dolibarr CRM/ERP 10.0.3 allows viewimage.php?file= Stored XSS due to JavaScript execution in an SVG image for a profile picture. - Severity: Unrated - Published: Nov 26, 2019 - Affected: through 10.0.3. ### [CVE-2019-17576](https://cve.now/CVE-2019-17576): An issue was discovered in Dolibarr 10.0.2. - Severity: Unrated - Published: Oct 16, 2019 - Affected: versions 10.0.2. ### [CVE-2019-17577](https://cve.now/CVE-2019-17577): An issue was discovered in Dolibarr 10.0.2. - Severity: Unrated - Published: Oct 16, 2019 - Affected: versions 10.0.2. ### [CVE-2019-17578](https://cve.now/CVE-2019-17578): An issue was discovered in Dolibarr 10.0.2. - Severity: Unrated - Published: Oct 16, 2019 - Affected: versions 10.0.2. ### [CVE-2019-17223](https://cve.now/CVE-2019-17223): There is HTML Injection in the Note field in Dolibarr ERP/CRM 10.0.2 via user/note.php. - Severity: Unrated - Published: Oct 15, 2019 - Affected: fixed in 11.0.1. ### [CVE-2019-16688](https://cve.now/CVE-2019-16688): Dolibarr 9.0.5 has stored XSS in an Email Template section to mails\_templates.php. - Severity: Unrated - Published: Sep 27, 2019 - Affected: versions 9.0.5. ### [CVE-2019-16687](https://cve.now/CVE-2019-16687): Dolibarr 9.0.5 has stored XSS in a User Profile in a Signature section to card.php. - Severity: Unrated - Published: Sep 27, 2019 - Affected: versions 9.0.5. ### [CVE-2019-16686](https://cve.now/CVE-2019-16686): Dolibarr 9.0.5 has stored XSS in a User Note section to note.php. - Severity: Unrated - Published: Sep 27, 2019 - Affected: versions 9.0.5. ### [CVE-2019-16685](https://cve.now/CVE-2019-16685): Dolibarr 9.0.5 has stored XSS vulnerability via a User Group Description section to card.php. - Severity: Unrated - Published: Sep 27, 2019 - Affected: versions 9.0.5. ### [CVE-2019-16197](https://cve.now/CVE-2019-16197): In htdocs/societe/card.php in Dolibarr 10.0.1, the value of the User-Agent HTTP header is copied into the HTML document as plain text… - Severity: Unrated - Published: Sep 16, 2019 - Affected: fixed in 10.0.2. ### [CVE-2019-15062](https://cve.now/CVE-2019-15062): An issue was discovered in Dolibarr 11.0.0-alpha. - Severity: Unrated - Published: Aug 14, 2019 - Affected: from 10.0, fixed in 10.0.2. ### [CVE-2019-11201](https://cve.now/CVE-2019-11201): Dolibarr ERP/CRM 9.0.1 provides a module named website that provides for creation of public websites with a WYSIWYG editor. - Severity: Unrated - Published: Jul 29, 2019 - Affected: fixed in 9.0.3. ### [CVE-2019-11200](https://cve.now/CVE-2019-11200): Dolibarr ERP/CRM 9.0.1 provides a web-based functionality that backs up the database content to a dump file. - Severity: Unrated - Published: Jul 29, 2019 - Affected: fixed in 9.0.3. ### [CVE-2019-1010054](https://cve.now/CVE-2019-1010054): Dolibarr 7.0.0 is affected by: Cross Site Request Forgery (CSRF). - Severity: Unrated - Published: Jul 18, 2019 - Affected: versions 7.0.0. ### [CVE-2019-1010016](https://cve.now/CVE-2019-1010016): Dolibarr 6.0.4 is affected by: Cross Site Scripting (XSS). - Severity: Unrated - Published: Jul 15, 2019 - Affected: versions 6.0.4. ### [CVE-2018-16809](https://cve.now/CVE-2018-16809): An issue was discovered in Dolibarr through 7.0.0. - Severity: Unrated - Published: Mar 7, 2019 - Affected: from 3.8, through 7.0.0. ### [CVE-2018-16808](https://cve.now/CVE-2018-16808): An issue was discovered in Dolibarr through 7.0.0. - Severity: Unrated - Published: Mar 7, 2019 - Affected: fixed in 7.0.1. ### [CVE-2018-19998](https://cve.now/CVE-2018-19998): SQL injection vulnerability in user/card.php in Dolibarr version 8.0.2 allows remote authenticated users to execute arbitrary SQL commands… - Severity: Unrated - Published: Jan 3, 2019 - Affected: fixed in 8.0.4. ### [CVE-2018-19995](https://cve.now/CVE-2018-19995): A stored cross-site scripting (XSS) vulnerability in Dolibarr 8.0.2 allows remote authenticated users to inject arbitrary web script or… - Severity: Unrated - Published: Jan 3, 2019 - Affected: fixed in 8.0.4. ### [CVE-2018-19994](https://cve.now/CVE-2018-19994): An error-based SQL injection vulnerability in product/card.php in Dolibarr version 8.0.2 allows remote authenticated users to execute… - Severity: Unrated - Published: Jan 3, 2019 - Affected: fixed in 8.0.4. ### [CVE-2018-19993](https://cve.now/CVE-2018-19993): A reflected cross-site scripting (XSS) vulnerability in Dolibarr 8.0.2 allows remote attackers to inject arbitrary web script or HTML via… - Severity: Unrated - Published: Jan 3, 2019 - Affected: fixed in 8.0.4. ### [CVE-2018-19992](https://cve.now/CVE-2018-19992): A stored cross-site scripting (XSS) vulnerability in Dolibarr 8.0.2 allows remote authenticated users to inject arbitrary web script or… - Severity: Unrated - Published: Jan 3, 2019 - Affected: fixed in 8.0.4. ### [CVE-2018-19799](https://cve.now/CVE-2018-19799): Dolibarr ERP/CRM through 8.0.3 has /exports/export.php?datatoexport= XSS. - Severity: Unrated - Published: Dec 26, 2018 - Affected: through 8.0.3. ### [CVE-2018-13450](https://cve.now/CVE-2018-13450): SQL injection vulnerability in product/card.php in Dolibarr ERP/CRM version 7.0.3 allows remote attackers to execute arbitrary SQL… - Severity: Unrated - Published: Jul 8, 2018 - Affected: from 7.0.3, fixed in 7.0.4. ### [CVE-2018-13449](https://cve.now/CVE-2018-13449): SQL injection vulnerability in product/card.php in Dolibarr ERP/CRM version 7.0.3 allows remote attackers to execute arbitrary SQL… - Severity: Unrated - Published: Jul 8, 2018 - Affected: from 7.0.3, fixed in 7.0.4. ### [CVE-2018-13448](https://cve.now/CVE-2018-13448): SQL injection vulnerability in product/card.php in Dolibarr ERP/CRM version 7.0.3 allows remote attackers to execute arbitrary SQL… - Severity: Unrated - Published: Jul 8, 2018 - Affected: from 7.0.3, fixed in 7.0.4. ### [CVE-2018-13447](https://cve.now/CVE-2018-13447): SQL injection vulnerability in product/card.php in Dolibarr ERP/CRM version 7.0.3 allows remote attackers to execute arbitrary SQL… - Severity: Unrated - Published: Jul 8, 2018 - Affected: from 7.0.3, fixed in 7.0.4. ### [CVE-2018-9019](https://cve.now/CVE-2018-9019): SQL Injection vulnerability in Dolibarr before version 7.0.2 allows remote attackers to execute arbitrary SQL commands via the sortfield… - Severity: Unrated - Published: May 22, 2018 - Affected: fixed in 7.0.2. ### [CVE-2018-10095](https://cve.now/CVE-2018-10095): Cross-site scripting (XSS) vulnerability in Dolibarr before 7.0.2 allows remote attackers to inject arbitrary web script or HTML via the… - Severity: Unrated - Published: May 22, 2018 - Affected: fixed in 7.0.2. ### [CVE-2018-10094](https://cve.now/CVE-2018-10094): SQL injection vulnerability in Dolibarr before 7.0.2 allows remote attackers to execute arbitrary SQL commands via vectors involving… - Severity: Unrated - Published: May 22, 2018 - Affected: fixed in 7.0.2. ### [CVE-2018-10092](https://cve.now/CVE-2018-10092): The admin panel in Dolibarr before 7.0.2 might allow remote attackers to execute arbitrary commands by leveraging support for updating the… - Severity: Unrated - Published: May 22, 2018 - Affected: fixed in 7.0.2. ### [CVE-2017-9839](https://cve.now/CVE-2017-9839): Dolibarr ERP/CRM is affected by SQL injection in versions before 5.0.4 via product/stats/card.php (type parameter). - Severity: Unrated - Published: Apr 11, 2018 - Affected: fixed in 5.0.4. ### [CVE-2017-9838](https://cve.now/CVE-2017-9838): Dolibarr ERP/CRM is affected by multiple reflected Cross-Site Scripting (XSS) vulnerabilities in versions before 5.0.4: index.php… - Severity: Unrated - Published: Apr 11, 2018 - Affected: fixed in 5.0.4. ### [CVE-2017-18260](https://cve.now/CVE-2017-18260): Dolibarr ERP/CRM is affected by multiple SQL injection vulnerabilities in versions through 7.0.0 via comm/propal/list.php (viewstatut… - Severity: Unrated - Published: Apr 11, 2018 - Affected: through 7.0.0. ### [CVE-2017-18259](https://cve.now/CVE-2017-18259): Dolibarr ERP/CRM is affected by stored Cross-Site Scripting (XSS) in versions through 7.0.0. - Severity: Unrated - Published: Apr 11, 2018 - Affected: through 7.0.0. ### [CVE-2017-1000509](https://cve.now/CVE-2017-1000509): Dolibarr version 6.0.2 contains a Cross Site Scripting (XSS) vulnerability in Product details that can result in execution of javascript… - Severity: Unrated - Published: Feb 9, 2018 - Affected: fixed in 7.0.0. ### [CVE-2017-17971](https://cve.now/CVE-2017-17971): The test\_sql\_and\_script\_inject function in htdocs/main.inc.php in Dolibarr ERP/CRM 6.0.4 blocks some event attributes but neither onclick… - Severity: Unrated - Published: Dec 29, 2017 - Affected: fixed in 6.0.5. ### [CVE-2017-17900](https://cve.now/CVE-2017-17900): SQL injection vulnerability in fourn/index.php in Dolibarr ERP/CRM version 6.0.4 allows remote attackers to execute arbitrary SQL commands… - Severity: Unrated - Published: Dec 24, 2017 - Affected: fixed in 6.0.5. ### [CVE-2017-17899](https://cve.now/CVE-2017-17899): SQL injection vulnerability in adherents/subscription/info.php in Dolibarr ERP/CRM version 6.0.4 allows remote attackers to execute… - Severity: Unrated - Published: Dec 24, 2017 - Affected: fixed in 6.0.5. ### [CVE-2017-17898](https://cve.now/CVE-2017-17898): Dolibarr ERP/CRM version 6.0.4 does not block direct requests to \*.tpl.php files, which allows remote attackers to obtain sensitive… - Severity: Unrated - Published: Dec 24, 2017 - Affected: fixed in 6.0.5. ### [CVE-2017-17897](https://cve.now/CVE-2017-17897): SQL injection vulnerability in comm/multiprix.php in Dolibarr ERP/CRM version 6.0.4 allows remote attackers to execute arbitrary SQL… - Severity: Unrated - Published: Dec 24, 2017 - Affected: fixed in 6.0.5. ### [CVE-2017-14242](https://cve.now/CVE-2017-14242): SQL injection vulnerability in don/list.php in Dolibarr version 6.0.0 allows remote attackers to execute arbitrary SQL commands via the… - Severity: Unrated - Published: Sep 11, 2017 - Affected: fixed in 6.0.1. ### [CVE-2017-14241](https://cve.now/CVE-2017-14241): Cross-site scripting (XSS) vulnerability in Dolibarr ERP/CRM 6.0.0 allows remote authenticated users to inject arbitrary web script or… - Severity: Unrated - Published: Sep 11, 2017 - Affected: fixed in 6.0.1. ### [CVE-2017-14240](https://cve.now/CVE-2017-14240): There is a sensitive information disclosure vulnerability in document.php in Dolibarr ERP/CRM version 6.0.0 via the file parameter. - Severity: Unrated - Published: Sep 11, 2017 - Affected: fixed in 6.0.1. ### [CVE-2017-14239](https://cve.now/CVE-2017-14239): Multiple cross-site scripting (XSS) vulnerabilities in Dolibarr ERP/CRM 6.0.0 allow remote authenticated users to inject arbitrary web… - Severity: Unrated - Published: Sep 11, 2017 - Affected: from 6.0.0, fixed in 6.0.1. ### [CVE-2017-14238](https://cve.now/CVE-2017-14238): SQL injection vulnerability in admin/menus/edit.php in Dolibarr ERP/CRM version 6.0.0 allows remote attackers to execute arbitrary SQL… - Severity: Unrated - Published: Sep 11, 2017 - Affected: fixed in 6.0.1. ### [CVE-2017-9840](https://cve.now/CVE-2017-9840): Dolibarr ERP/CRM 5.0.3 and prior allows low-privilege users to upload files of dangerous types, which can result in arbitrary code… - Severity: Unrated - Published: Jun 25, 2017 - Affected: through 5.0.3. ### [CVE-2017-9435](https://cve.now/CVE-2017-9435): Dolibarr ERP/CRM before 5.0.3 is vulnerable to a SQL injection in user/index.php (search\_supervisor and search\_statut parameters). - Severity: Unrated - Published: Jun 5, 2017 - Affected: fixed in 5.0.3. ### [CVE-2017-8879](https://cve.now/CVE-2017-8879): Dolibarr ERP/CRM 4.0.4 allows password changes without supplying the current password, which makes it easier for physically proximate… - Severity: Unrated - Published: May 10, 2017 - Affected: versions 4.0.4. ### [CVE-2017-7888](https://cve.now/CVE-2017-7888): Dolibarr ERP/CRM 4.0.4 stores passwords with the MD5 algorithm, which makes brute-force attacks easier. - Severity: Unrated - Published: May 10, 2017 - Affected: through 4.0.4. ### [CVE-2017-7887](https://cve.now/CVE-2017-7887): Dolibarr ERP/CRM 4.0.4 has XSS in doli/societe/list.php via the sall parameter. - Severity: Unrated - Published: May 10, 2017 - Affected: through 4.0.4. ### [CVE-2017-7886](https://cve.now/CVE-2017-7886): Dolibarr ERP/CRM 4.0.4 has SQL Injection in doli/theme/eldy/style.css.php via the lang parameter. - Severity: Unrated - Published: May 10, 2017 - Affected: versions 4.0.4. ### [CVE-2016-1912](https://cve.now/CVE-2016-1912): Multiple cross-site scripting (XSS) vulnerabilities in Dolibarr ERP/CRM 3.8.3 allow remote authenticated users to inject arbitrary web… - Severity: Unrated - Published: Jan 15, 2016 - Affected: through 3.8.3. ### [CVE-2015-3935](https://cve.now/CVE-2015-3935): Multiple cross-site scripting (XSS) vulnerabilities in Dolibarr ERP/CRM 3.5 and 3.6 allow remote attackers to inject arbitrary web script… - Severity: Unrated - Published: Jun 10, 2015 - Affected: from 3.5.0, fixed in 3.5.8. --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/packages/packagist/dolibarr/dolibarr Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.