# cve.now: Dolibarr

The newest entries naming Dolibarr as an affected vendor (up to 200), of 64 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-125754](https://cve.now/CVE-2026-125754.md): Dolibarr 20.0.0 through 23.0.4 and 24.x before 24.0.2 IDOR via ExpenseReport Payment API (CVSS 7.1)
- [CVE-2026-33944](https://cve.now/CVE-2026-33944.md): Dolibarr: SQL Injection in societe/class/societe.class.php via localtax1\_value parameter (CVSS 8.8)
- [CVE-2026-118754](https://cve.now/CVE-2026-118754.md): Dolibarr ERP CRM before 24.0.2 Missing Authorization via public recruitment view.php (CVSS 6.9)
- [CVE-2026-116219](https://cve.now/CVE-2026-116219.md): Dolibarr ERP CRM before 24.0.0 OS Command Injection via mysqldump Parameter (CVSS 8.6)
- [CVE-2026-116218](https://cve.now/CVE-2026-116218.md): Dolibarr ERP CRM 19.0.0 before 23.0.4 SQL Injection via bankaccounts API type field (CVSS 7.2)
- [CVE-2026-110874](https://cve.now/CVE-2026-110874.md): Dolibarr before 23.0.4 PHP Object Injection via jsonOrUnserialize() (CVSS 7.5)
- [CVE-2026-107706](https://cve.now/CVE-2026-107706.md): Dolibarr before 24.0.2 Incorrect Authorization via updateextrafield.php (CVSS 5.3)
- [CVE-2026-89013](https://cve.now/CVE-2026-89013.md): Dolibarr 23.0.4 \< 24.0.1 Authorization Bypass via hashp Parameter in document.php (CVSS 8.7)
- [CVE-2026-89012](https://cve.now/CVE-2026-89012.md): Dolibarr 24.0.0 \< 24.0.1 SQL Filter Denylist Bypass via sqlfilters Parameter (CVSS 7.1)
- [CVE-2026-82633](https://cve.now/CVE-2026-82633.md): Dolibarr 10.0.0 before 24.0.0 Missing Authorization on REST Users Groups Endpoint (CVSS 5.3)
- [CVE-2026-81730](https://cve.now/CVE-2026-81730.md): Dolibarr 9.0.0 through 23.0.4 Path Traversal via EmailCollector Attachment Filename (CVSS 8.8)
- [CVE-2026-81729](https://cve.now/CVE-2026-81729.md): Dolibarr before 23.0.4 Incorrect Authorization on REST API Document Deletion (CVSS 7.1)
- [CVE-2026-81728](https://cve.now/CVE-2026-81728.md): Dolibarr before 24.0.0 SQL Injection via the CSV and XLSX Import Update Keys (CVSS 8.6)
- [CVE-2026-77923](https://cve.now/CVE-2026-77923.md): Dolibarr 21.0.0 \< 24.0.0 Authorization Bypass via clonetasks Mass Action (CVSS 5.3)
- [CVE-2026-71511](https://cve.now/CVE-2026-71511.md): Dolibarr \< 24.0.0 Members REST API Sensitive Data Exposure via Member Endpoints (CVSS 7.1)
- [CVE-2026-71510](https://cve.now/CVE-2026-71510.md): Dolibarr \< 24.0.0 Users REST API SQL Injection via filter parameter (CVSS 7.1)
- [CVE-2026-71509](https://cve.now/CVE-2026-71509.md): Dolibarr \< 24.0.0 Expense Report REST API Improper Authorization via Update Endpoint (CVSS 7.1)
- [CVE-2026-71508](https://cve.now/CVE-2026-71508.md): Dolibarr \< 24.0.0 REST API Improper Authorization via User Update Endpoint (CVSS 7.1)
- [CVE-2026-71507](https://cve.now/CVE-2026-71507.md): Dolibarr \< 24.0.0 REST API Broken Object-Level Authorization via Bank Account Routes (CVSS 7.1)
- [CVE-2026-71506](https://cve.now/CVE-2026-71506.md): Dolibarr \< 24.0.0 Payments REST API Improper Authorization via Delete Endpoint (CVSS 7.2)
- [CVE-2026-71505](https://cve.now/CVE-2026-71505.md): Dolibarr \< 24.0.0 REST API Broken Object-Level Authorization via Third-Party Write Route (CVSS 7.1)
- [CVE-2026-71504](https://cve.now/CVE-2026-71504.md): Dolibarr \< 24.0.0 Members REST API Improper Authorization via Password Reset (CVSS 8.6)
- [CVE-2026-71503](https://cve.now/CVE-2026-71503.md): Dolibarr \< 24.0.0 Reflected XSS via Extra Fields Administration Template (CVSS 5.1)
- [CVE-2026-78160](https://cve.now/CVE-2026-78160.md): Dolibarr ERP User Notes note.php authorization (CVSS 5.3)
- [CVE-2026-19350](https://cve.now/CVE-2026-19350.md): Dolibarr ERP TakePOS invoice.php fail authorization (CVSS 5.3)
- [CVE-2026-58376](https://cve.now/CVE-2026-58376.md): Dolibarr - SQL Injection via sqlfilters Parameter in Multiple REST API List Endpoints (CVSS 7.6)
- [CVE-2026-11619](https://cve.now/CVE-2026-11619.md): Dolibarr ERP CRM Legacy Filemanager config.inc.php improper authorization (CVSS 5.3)
- [CVE-2026-10215](https://cve.now/CVE-2026-10215.md): Dolibarr ERP CRM Leave Request REST API api\_holidays.class.php checkUserAccessToObject improper authorization (CVSS 5.3)
- [CVE-2026-10154](https://cve.now/CVE-2026-10154.md): Dolibarr ERP CRM messaging.php authorization (CVSS 5.3)
- [CVE-2018-25357](https://cve.now/CVE-2018-25357.md): Dolibarr ERP CRM 7.0.3 Remote Code Execution via install/step1.php (CVSS 9.3)
- [CVE-2025-67486](https://cve.now/CVE-2025-67486.md): Dolibarr has an Authenticated Remote Code Execution via eval() injection in user extrafields (CVSS 8.6)
- [CVE-2026-7689](https://cve.now/CVE-2026-7689.md): Dolibarr ERP CRM Online Signature security.lib.php dol\_verifyHash signature verification (CVSS 6.3)
- [CVE-2026-7688](https://cve.now/CVE-2026-7688.md): Dolibarr ERP CRM Shipments API Endpoint expedition.class.php \_checkValForAPI sql injection (CVSS 2.3)
- [CVE-2026-23500](https://cve.now/CVE-2026-23500.md): Dolibarr: OS Command Injection (RCE) via MAIN\_ODT\_AS\_PDF configuration (CVSS 9.4)
- [CVE-2019-25710](https://cve.now/CVE-2019-25710.md): Dolibarr ERP-CRM 8.0.4 SQL Injection via rowid Parameter (CVSS 8.8)
- [CVE-2026-22666](https://cve.now/CVE-2026-22666.md): Dolibarr ERP/CRM \< 23.0.2 Authenticated RCE via dol\_eval\_standard() (CVSS 8.6)
- [CVE-2026-34036](https://cve.now/CVE-2026-34036.md): Dolibarr Core Discloses Sensitive Data via Authenticated Local File Inclusion in selectobject.php (CVSS 6.5)
- [CVE-2019-25452](https://cve.now/CVE-2019-25452.md): Dolibarr ERP/CRM 10.0.1 SQL Injection via elemid (CVSS 8.8)
- [CVE-2019-25450](https://cve.now/CVE-2019-25450.md): Dolibarr ERP/CRM 10.0.1 SQL Injection via card.php (CVSS 7.1)
- [CVE-2020-36966](https://cve.now/CVE-2020-36966.md): Dolibarr 11.0.3 - 'ldap.php' - Persistent Cross-Site Scripting (CVSS 5.1)
- [CVE-2021-47779](https://cve.now/CVE-2021-47779.md): Dolibarr ERP-CRM 14.0.2 - Stored Cross-Site Scripting (XSS) / Privilege Escalation (CVSS 8.4)
- [CVE-2021-3991](https://cve.now/CVE-2021-3991.md): Improper Authorization in dolibarr/dolibarr (CVSS 4.3)
- [CVE-2024-5315](https://cve.now/CVE-2024-5315.md): Multiple vulnerabilities in DOLIBARR's ERP CMS (CVSS 9.1)
- [CVE-2024-5314](https://cve.now/CVE-2024-5314.md): Multiple vulnerabilities in DOLIBARR's ERP CMS (CVSS 9.1)
- [CVE-2024-23817](https://cve.now/CVE-2024-23817.md): Dolibarr Application Home Page HTML injection vulnerability (CVSS 7.1)
- [CVE-2023-4198](https://cve.now/CVE-2023-4198.md): Dolibarr ERP CRM (\<= 17.0.3) Improper Access Control (CVSS 6.5)
- [CVE-2023-4197](https://cve.now/CVE-2023-4197.md): Dolibarr ERP CRM (\<= 18.0.1) Improper Input Sanitization Authenticated RCE (CVSS 7.5)
- [CVE-2023-5842](https://cve.now/CVE-2023-5842.md): Cross-site Scripting (XSS) - Stored in dolibarr/dolibarr (CVSS 4.8)
- [CVE-2023-5323](https://cve.now/CVE-2023-5323.md): Cross-site Scripting (XSS) - Generic in dolibarr/dolibarr (CVSS 5.4)
- [CVE-2022-4093](https://cve.now/CVE-2022-4093.md): SQL Injection in dolibarr/dolibarr (CVSS 8.1)
- [CVE-2022-2060](https://cve.now/CVE-2022-2060.md): Cross-site Scripting (XSS) - Stored in dolibarr/dolibarr (CVSS 8.4)
- [CVE-2022-0819](https://cve.now/CVE-2022-0819.md): Code Injection in dolibarr/dolibarr (CVSS 7.2)
- [CVE-2022-0746](https://cve.now/CVE-2022-0746.md): Business Logic Errors in dolibarr/dolibarr (CVSS 4.3)
- [CVE-2022-0731](https://cve.now/CVE-2022-0731.md): Improper Access Control (IDOR) in dolibarr/dolibarr (CVSS 5.4)
- [CVE-2022-0414](https://cve.now/CVE-2022-0414.md): Improper Validation of Specified Quantity in Input in dolibarr/dolibarr (CVSS 4.1)
- [CVE-2022-0224](https://cve.now/CVE-2022-0224.md): SQL Injection in dolibarr/dolibarr (CVSS 8.3)
- [CVE-2022-0174](https://cve.now/CVE-2022-0174.md): Improper Validation of Specified Quantity in Input in dolibarr/dolibarr (CVSS 4.3)
- [CVE-2021-25956](https://cve.now/CVE-2021-25956.md): Improper User Access Control in "Dolibarr" Leads to Account Takeover (CVSS 4.7)
- [CVE-2021-25957](https://cve.now/CVE-2021-25957.md): Account Takeover in "Dolibarr" via Password Reset Functionality (CVSS 8.8)
- [CVE-2021-25955](https://cve.now/CVE-2021-25955.md): Stored XSS in “Dolibarr” leads to privilege escalation (CVSS 9.0)
- [CVE-2021-25954](https://cve.now/CVE-2021-25954.md): Improper Access Control in “Dolibarr” (CVSS 4.3)
- [CVE-2013-2093](https://cve.now/CVE-2013-2093.md): Dolibarr ERP/CRM 3.3.1 does not properly validate user input in viewimage.php and barcode.lib.php which allows remote attackers to execute a (no CVSS)
- [CVE-2013-2092](https://cve.now/CVE-2013-2092.md): Cross-site Scripting (XSS) in Dolibarr ERP/CRM 3.3.1 allows remote attackers to inject arbitrary web script or HTML in functions.lib.php. (no CVSS)
- [CVE-2013-2091](https://cve.now/CVE-2013-2091.md): SQL injection vulnerability in Dolibarr ERP/CRM 3.3.1 allows remote attackers to execute arbitrary SQL commands via the 'pays' parameter in (no CVSS)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/dolibarr
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.