Dolibarr vulnerabilities
64 CVEs and advisories name Dolibarr as an affected vendor, newest first. Follow it as a feed.
- CVE-2025-67486Dolibarr has an Authenticated Remote Code Execution via eval() injection in user extrafields
- CVE-2026-7689Dolibarr ERP CRM Online Signature security.lib.php dol_verifyHash signature verification
- CVE-2026-7688Dolibarr ERP CRM Shipments API Endpoint expedition.class.php _checkValForAPI sql injection
- CVE-2026-23500Dolibarr: OS Command Injection (RCE) via MAIN_ODT_AS_PDF configuration
- CVE-2019-25710Dolibarr ERP-CRM 8.0.4 SQL Injection via rowid Parameter
- CVE-2026-22666Dolibarr ERP/CRM < 23.0.2 Authenticated RCE via dol_eval_standard()
- CVE-2026-34036Dolibarr Core Discloses Sensitive Data via Authenticated Local File Inclusion in selectobject.php
- CVE-2019-25452Dolibarr ERP/CRM 10.0.1 SQL Injection via elemid
- CVE-2019-25450Dolibarr ERP/CRM 10.0.1 SQL Injection via card.php
- CVE-2020-36966Dolibarr 11.0.3 - 'ldap.php' - Persistent Cross-Site Scripting
- CVE-2021-47779Dolibarr ERP-CRM 14.0.2 - Stored Cross-Site Scripting (XSS) / Privilege Escalation
- CVE-2021-3991Improper Authorization in dolibarr/dolibarr
- CVE-2024-5315Multiple vulnerabilities in DOLIBARR's ERP CMS
- CVE-2024-5314Multiple vulnerabilities in DOLIBARR's ERP CMS
- CVE-2024-23817Dolibarr Application Home Page HTML injection vulnerability
- CVE-2023-4198Dolibarr ERP CRM (<= 17.0.3) Improper Access Control
- CVE-2023-4197Dolibarr ERP CRM (<= 18.0.1) Improper Input Sanitization Authenticated RCE
- CVE-2023-5842Cross-site Scripting (XSS) - Stored in dolibarr/dolibarr
- CVE-2023-5323Cross-site Scripting (XSS) - Generic in dolibarr/dolibarr
- CVE-2022-4093 SQL Injection in dolibarr/dolibarr
- CVE-2022-2060Cross-site Scripting (XSS) - Stored in dolibarr/dolibarr
- CVE-2022-0819Code Injection in dolibarr/dolibarr
- CVE-2022-0746Business Logic Errors in dolibarr/dolibarr
- CVE-2022-0731Improper Access Control (IDOR) in dolibarr/dolibarr
- CVE-2022-0414Improper Validation of Specified Quantity in Input in dolibarr/dolibarr
- CVE-2022-0224SQL Injection in dolibarr/dolibarr
- CVE-2022-0174Improper Validation of Specified Quantity in Input in dolibarr/dolibarr
- CVE-2021-25956Improper User Access Control in "Dolibarr" Leads to Account Takeover
- CVE-2021-25957Account Takeover in "Dolibarr" via Password Reset Functionality
- CVE-2021-25955Stored XSS in “Dolibarr” leads to privilege escalation