CVE-2026-19350 | Medium | 6.3 | 2026-08-09 | A vulnerability has been found in Dolibarr ERP up to 23.0.3. Affected is the function fail of the file htdocs/takepos/invoice.php of the component TakePOS Modu… |
CVE-2026-58376 | High | 7.6 | 2026-06-30 | Dolibarr through 23.0.3, fixed in commit 14db36e, contains a sql injection vulnerability that allows authenticated API users to exfiltrate arbitrary database c… |
CVE-2026-11619 | Medium | 6.3 | 2026-06-09 | A vulnerability was identified in Dolibarr ERP CRM up to 23.0.2. The impacted element is an unknown function of the file htdocs/core/filemanagerdol/connectors/… |
CVE-2026-10215 | Medium | 4.3 | 2026-06-01 | A security vulnerability has been detected in Dolibarr ERP CRM up to 23.0.1. Impacted is the function checkUserAccessToObject of the file htdocs/holiday/class/… |
CVE-2026-10154 | Medium | 4.3 | 2026-05-31 | A vulnerability has been found in Dolibarr ERP CRM 23.0.0/23.0.1/23.0.2. The affected element is an unknown function of the file htdocs/user/messaging.php. Suc… |
CVE-2018-25357 | Critical | 9.8 | 2026-05-23 | Dolibarr ERP CRM 7.0.3 contains a remote code execution vulnerability that allows unauthenticated attackers to execute arbitrary code by injecting PHP code thr… |
CVE-2025-67486 | High | 7.2 | 2026-05-08 | Dolibarr is an enterprise resource planning (ERP) and customer relationship management (CRM) software package. Versions 22.0.2 and earlier contains an authenti… |
CVE-2026-7689 | Low | 3.7 | 2026-05-03 | A security flaw has been discovered in Dolibarr ERP CRM up to 23.0.2. This vulnerability affects the function dol_verifyHash in the library htdocs/core/lib/sec… |
CVE-2026-7688 | Medium | 5.0 | 2026-05-03 | A vulnerability was identified in Dolibarr ERP CRM up to 23.0.2. This affects the function _checkValForAPI of the file htdocs/expedition/class/expedition.class… |
CVE-2026-31019 | High | 8.8 | 2026-04-21 | In the Website module of Dolibarr ERP & CRM 22.0.4 and below, the application uses blacklist-based filtering to restrict dangerous PHP functions related to sys… |
CVE-2026-31018 | High | 8.8 | 2026-04-21 | In Dolibarr ERP & CRM <= 22.0.4, PHP code detection and editing permission enforcement in the Website module is not applied consistently to all input parameter… |
CVE-2026-23500 | Critical | 9.1 | 2026-04-17 | Dolibarr is an enterprise resource planning (ERP) and customer relationship management (CRM) software package. In versions prior to 23.0.0 , the ODT to PDF con… |
CVE-2019-25710 | High | 8.2 | 2026-04-12 | Dolibarr ERP-CRM 8.0.4 contains an SQL injection vulnerability in the rowid parameter of the admin dict.php endpoint that allows attackers to execute arbitrary… |
CVE-2026-22666 | High | 7.2 | 2026-04-07 | Dolibarr ERP/CRM versions prior to 23.0.2 contain an authenticated remote code execution vulnerability in the dol_eval_standard() function that fails to apply… |
CVE-2026-34036 | Medium | 6.5 | 2026-03-31 | Dolibarr is an enterprise resource planning (ERP) and customer relationship management (CRM) software package. In versions 22.0.4 and prior, there is a Local F… |
CVE-2019-25452 | High | 7.5 | 2026-02-22 | Dolibarr ERP/CRM 10.0.1 contains an SQL injection vulnerability in the elemid POST parameter of the viewcat.php endpoint that allows unauthenticated attackers… |
CVE-2019-25450 | High | 7.5 | 2026-02-22 | Dolibarr ERP/CRM 10.0.1 contains multiple SQL injection vulnerabilities that allow authenticated attackers to manipulate database queries by injecting SQL code… |
CVE-2020-36966 | Medium | 6.4 | 2026-01-30 | Dolibarr 11.0.3 contains a persistent cross-site scripting vulnerability in LDAP synchronization settings that allows attackers to inject malicious scripts thr… |
CVE-2021-47779 | Medium | 5.4 | 2026-01-16 | Dolibarr ERP-CRM 14.0.2 contains a stored cross-site scripting vulnerability in the ticket creation module that allows low-privilege users to inject malicious… |
CVE-2025-56588 | High | 8.8 | 2025-10-01 | Dolibarr ERP & CRM v21.0.1 were discovered to contain a remote code execution (RCE) vulnerability in the User module configuration via the computed field param… |
CVE-2024-55228 | Critical | 9.0 | 2025-01-27 | A cross-site scripting (XSS) vulnerability in the Product module of Dolibarr v21.0.0-beta allows attackers to execute arbitrary web scripts or HTMl via a craft… |
CVE-2024-55227 | Critical | 9.0 | 2025-01-27 | A cross-site scripting (XSS) vulnerability in the Events/Agenda module of Dolibarr v21.0.0-beta allows attackers to execute arbitrary web scripts or HTMl via a… |
CVE-2021-3991 | Medium | 4.3 | 2024-11-15 | An Improper Authorization vulnerability exists in Dolibarr versions prior to the 'develop' branch. A user with restricted permissions in the 'Reception' sectio… |
CVE-2024-37821 | High | 8.8 | 2024-06-18 | An arbitrary file upload vulnerability in the Upload Template function of Dolibarr ERP CRM up to v19.0.1 allows attackers to execute arbitrary code via uploadi… |
CVE-2024-5315 | Critical | 9.1 | 2024-05-24 | Vulnerabilities in Dolibarr ERP - CRM that affect version 9.0.1 and allow SQL injection. These vulnerabilities could allow a remote attacker to send a speciall… |
CVE-2024-5314 | Critical | 9.1 | 2024-05-24 | Vulnerabilities in Dolibarr ERP - CRM that affect version 9.0.1 and allow SQL injection. These vulnerabilities could allow a remote attacker to send a speciall… |
CVE-2024-31503 | High | 7.5 | 2024-04-17 | Incorrect access control in Dolibarr ERP CRM versions 19.0.0 and before, allows authenticated attackers to steal victim users' session cookies and CSRF protect… |
CVE-2024-29477 | High | 8.8 | 2024-04-03 | Lack of sanitization during Installation Process in Dolibarr ERP CRM up to version 19.0.0 allows an attacker with adjacent access to the network to execute arb… |
CVE-2024-23817 | High | 7.1 | 2024-01-25 | Dolibarr is an enterprise resource planning (ERP) and customer relationship management (CRM) software package. Version 18.0.4 has a HTML Injection vulnerabilit… |
CVE-2023-4198 | Medium | 6.5 | 2023-11-01 | Improper Access Control in Dolibarr ERP CRM <= v17.0.3 allows an unauthorized authenticated user to read a database table containing customer data |
CVE-2023-4197 | High | 7.5 | 2023-11-01 | Improper input validation in Dolibarr ERP CRM <= v18.0.1 fails to strip certain PHP code from user-supplied input when creating a Website, allowing an attacker… |
CVE-2023-5842 | Medium | 4.8 | 2023-10-30 | Cross-site Scripting (XSS) - Stored in GitHub repository dolibarr/dolibarr prior to 16.0.5. |
CVE-2023-5323 | Medium | 6.1 | 2023-10-01 | Cross-site Scripting (XSS) - Generic in GitHub repository dolibarr/dolibarr prior to 18.0. |
CVE-2023-38888 | Critical | 9.6 | 2023-09-20 | Cross Site Scripting vulnerability in Dolibarr ERP CRM v.17.0.1 and before allows a remote attacker to obtain sensitive information and execute arbitrary code… |
CVE-2023-38887 | High | 8.8 | 2023-09-20 | File Upload vulnerability in Dolibarr ERP CRM v.17.0.1 and before allows a remote attacker to execute arbitrary code and obtain sensitive information via the e… |
CVE-2023-38886 | High | 7.2 | 2023-09-20 | An issue in Dolibarr ERP CRM v.17.0.1 and before allows a remote privileged attacker to execute arbitrary code via a crafted command/script. |
CVE-2023-33568 | High | 7.5 | 2023-06-13 | An issue in Dolibarr 16 before 16.0.5 allows unauthenticated attackers to perform a database dump and access a company's entire customer file, prospects, suppl… |
CVE-2023-30253 | High | 8.8 | 2023-05-29 | Dolibarr before 17.0.1 allows remote code execution by an authenticated user via an uppercase manipulation: <?PHP instead of <?php in injected data. |
CVE-2022-4093 | Critical | 9.8 | 2022-11-21 | SQL injection attacks can result in unauthorized access to sensitive data, such as passwords, credit card details, or personal user information. Many high-prof… |
CVE-2022-43138 | Critical | 9.8 | 2022-11-17 | Dolibarr Open Source ERP & CRM for Business before v14.0.1 allows attackers to escalate privileges via a crafted API. |
CVE-2022-40871 | Critical | 9.8 | 2022-10-12 | Dolibarr ERP & CRM <=15.0.3 is vulnerable to Eval injection. By default, any administrator can be added to the installation page of dolibarr, and if successful… |
CVE-2022-2060 | Medium | 5.4 | 2022-06-13 | Cross-site Scripting (XSS) - Stored in GitHub repository dolibarr/dolibarr prior to 16.0. |
CVE-2022-30875 | Medium | 6.1 | 2022-06-08 | Dolibarr 12.0.5 is vulnerable to Cross Site Scripting (XSS) via Sql Error Page. |
CVE-2021-37517 | High | 7.5 | 2022-03-31 | An Access Control vulnerability exists in Dolibarr ERP/CRM 13.0.2, fixed version is 14.0.0,in the forgot-password function becuase the application allows email… |
CVE-2021-36625 | High | 8.8 | 2022-03-31 | An SQL Injection vulnerability exists in Dolibarr ERP/CRM 13.0.2 (fixed version is 14.0.0) via a POST request to the country_id parameter in an UPDATE statemen… |
CVE-2022-0819 | High | 8.8 | 2022-03-02 | Code Injection in GitHub repository dolibarr/dolibarr prior to 15.0.1. |
CVE-2022-0746 | Medium | 4.3 | 2022-02-25 | Business Logic Errors in GitHub repository dolibarr/dolibarr prior to 16.0. |
CVE-2022-0731 | Medium | 6.5 | 2022-02-23 | Improper Access Control (IDOR) in GitHub repository dolibarr/dolibarr prior to 16.0. |
CVE-2022-0414 | Medium | 4.3 | 2022-01-31 | Improper Validation of Specified Quantity in Input in Packagist dolibarr/dolibarr prior to 16.0. |
CVE-2022-0224 | Critical | 9.8 | 2022-01-14 | dolibarr is vulnerable to Improper Neutralization of Special Elements used in an SQL Command |
CVE-2022-0174 | Medium | 4.3 | 2022-01-10 | Improper Validation of Specified Quantity in Input vulnerability in dolibarr dolibarr/dolibarr. |
CVE-2022-22293 | Medium | 5.4 | 2022-01-02 | admin/limits.php in Dolibarr 7.0.2 allows HTML injection, as demonstrated by the MAIN_MAX_DECIMALS_TOT parameter. |
CVE-2021-42220 | Medium | 5.4 | 2021-12-15 | A Cross Site Scripting (XSS) vulnerability exists in Dolibarr before 14.0.3 via the ticket creation flow. Exploitation requires that an admin copies the payloa… |
CVE-2021-33816 | Critical | 9.8 | 2021-11-10 | The website builder module in Dolibarr 13.0.2 allows remote PHP code execution because of an incomplete protection mechanism in which system, exec, and shell_e… |
CVE-2021-33618 | Medium | 6.1 | 2021-11-10 | Dolibarr ERP and CRM 13.0.2 allows XSS via object details, as demonstrated by > and < characters in the onpointermove attribute of a BODY element to the user-m… |
CVE-2021-25957 | High | 8.8 | 2021-08-17 | In “Dolibarr” application, v2.8.1 to v13.0.2 are vulnerable to account takeover via password reset functionality. A low privileged attacker can reset the passw… |
CVE-2021-25956 | Medium | 4.7 | 2021-08-17 | In “Dolibarr” application, v3.3.beta1_20121221 to v13.0.2 have “Modify” access for admin level users to change other user’s details but fails to validate alrea… |
CVE-2021-25955 | Critical | 9.0 | 2021-08-15 | In “Dolibarr ERP CRM”, WYSIWYG Editor module, v2.8.1 to v13.0.2 are affected by a stored XSS vulnerability that allows low privileged application users to stor… |
CVE-2021-25954 | Medium | 4.3 | 2021-08-09 | In “Dolibarr” application, 2.8.1 to 13.0.4 don’t restrict or incorrectly restricts access to a resource from an unauthorized actor. A low privileged attacker c… |
CVE-2020-35136 | High | 7.2 | 2020-12-23 | Dolibarr 12.0.3 is vulnerable to authenticated Remote Code Execution. An attacker who has the access the admin dashboard can manipulate the backup function by… |
CVE-2020-14209 | High | 8.8 | 2020-09-02 | Dolibarr before 11.0.5 allows low-privilege users to upload files of dangerous types, leading to arbitrary code execution. This occurs because .pht and .phar f… |
CVE-2020-13828 | Medium | 5.4 | 2020-08-31 | Dolibarr 11.0.4 is affected by multiple stored Cross-Site Scripting (XSS) vulnerabilities that could allow remote authenticated attackers to inject arbitrary w… |
CVE-2020-14201 | Medium | 6.5 | 2020-08-21 | Dolibarr CRM before 11.0.5 allows privilege escalation. This could allow remote authenticated attackers to upload arbitrary files via societe/document.php in w… |
CVE-2020-14475 | Medium | 6.1 | 2020-06-19 | A reflected cross-site scripting (XSS) vulnerability in Dolibarr 11.0.3 allows remote attackers to inject arbitrary web script or HTML into public/notice.php (… |
CVE-2020-14443 | High | 8.8 | 2020-06-18 | A SQL injection vulnerability in accountancy/customer/card.php in Dolibarr 11.0.3 allows remote authenticated users to execute arbitrary SQL commands via the i… |
CVE-2020-13240 | Medium | 5.4 | 2020-05-20 | The DMS/ECM module in Dolibarr 11.0.4 allows users with the 'Setup documents directories' permission to rename uploaded files to have insecure file extensions… |
CVE-2020-13239 | Medium | 5.4 | 2020-05-20 | The DMS/ECM module in Dolibarr 11.0.4 renders user-uploaded .html files in the browser when the attachment parameter is removed from the direct download link… |
CVE-2020-13094 | Medium | 5.4 | 2020-05-18 | Dolibarr before 11.0.4 allows XSS. |
CVE-2020-12669 | High | 8.8 | 2020-05-06 | core/get_menudiv.php in Dolibarr before 11.0.4 allows remote authenticated attackers to bypass intended access restrictions via a non-alphanumeric menu paramet… |
CVE-2020-11825 | High | 8.8 | 2020-04-16 | In Dolibarr 10.0.6, forms are protected with a CSRF token against CSRF attacks. The problem is any CSRF token in any user's session can be used in another user… |
CVE-2020-11823 | Medium | 5.4 | 2020-04-16 | In Dolibarr 10.0.6, if USER_LOGIN_FAILED is active, there is a stored XSS vulnerability on the admin tools --> audit page. This may lead to stealing of the adm… |
CVE-2019-19212 | Critical | 9.8 | 2020-03-16 | Dolibarr ERP/CRM 3.0 through 10.0.3 allows XSS via the qty parameter to product/fournisseurs.php (product price screen). |
CVE-2019-19211 | Medium | 6.1 | 2020-03-16 | Dolibarr ERP/CRM before 10.0.3 has an Insufficient Filtering issue that can lead to user/card.php XSS. |
CVE-2019-19210 | Medium | 5.4 | 2020-03-16 | Dolibarr ERP/CRM before 10.0.3 allows XSS because uploaded HTML documents are served as text/html despite being renamed to .noexe files. |
CVE-2019-19209 | High | 7.5 | 2020-03-16 | Dolibarr ERP/CRM before 10.0.3 allows SQL Injection. |
CVE-2020-9016 | Medium | 5.4 | 2020-02-16 | Dolibarr 11.0 allows XSS via the joinfiles, topic, or code parameter, or the HTTP Referer header. |
CVE-2020-7996 | Medium | 6.1 | 2020-01-26 | htdocs/user/passwordforgotten.php in Dolibarr 10.0.6 allows XSS via the Referer HTTP header. |
CVE-2020-7995 | Critical | 9.8 | 2020-01-26 | The htdocs/index.php?mainmenu=home login page in Dolibarr 10.0.6 allows an unlimited rate of failed authentication attempts. |
CVE-2020-7994 | Medium | 6.1 | 2020-01-26 | Multiple cross-site scripting (XSS) vulnerabilities in Dolibarr 10.0.6 allow remote attackers to inject arbitrary web script or HTML via the (1) label[libelle]… |
CVE-2019-19206 | Medium | 5.4 | 2019-11-26 | Dolibarr CRM/ERP 10.0.3 allows viewimage.php?file= Stored XSS due to JavaScript execution in an SVG image for a profile picture. |
CVE-2013-2093 | Critical | 9.8 | 2019-11-20 | Dolibarr ERP/CRM 3.3.1 does not properly validate user input in viewimage.php and barcode.lib.php which allows remote attackers to execute arbitrary commands. |
CVE-2013-2092 | Medium | 6.1 | 2019-11-20 | Cross-site Scripting (XSS) in Dolibarr ERP/CRM 3.3.1 allows remote attackers to inject arbitrary web script or HTML in functions.lib.php. |
CVE-2013-2091 | Critical | 9.8 | 2019-11-20 | SQL injection vulnerability in Dolibarr ERP/CRM 3.3.1 allows remote attackers to execute arbitrary SQL commands via the 'pays' parameter in fiche.php. |
CVE-2019-17578 | Medium | 5.4 | 2019-10-16 | An issue was discovered in Dolibarr 10.0.2. It has XSS via the "outgoing email setup" feature in the admin/mails.php?action=edit URI via the "Sender email for… |
CVE-2019-17577 | Medium | 5.4 | 2019-10-16 | An issue was discovered in Dolibarr 10.0.2. It has XSS via the "outgoing email setup" feature in the admin/mails.php?action=edit URI via the "Email used for er… |
CVE-2019-17576 | Medium | 5.4 | 2019-10-16 | An issue was discovered in Dolibarr 10.0.2. It has XSS via the "outgoing email setup" feature in the /admin/mails.php?action=edit URI via the "Send all emails… |
CVE-2019-17223 | Medium | 6.1 | 2019-10-15 | There is HTML Injection in the Note field in Dolibarr ERP/CRM 10.0.2 via user/note.php. |
CVE-2019-16688 | Medium | 5.4 | 2019-09-27 | Dolibarr 9.0.5 has stored XSS in an Email Template section to mails_templates.php. A user with no privileges can inject script to attack the admin. (This store… |
CVE-2019-16687 | Medium | 5.4 | 2019-09-27 | Dolibarr 9.0.5 has stored XSS in a User Profile in a Signature section to card.php. A user with the "Create/modify other users, groups and permissions" privile… |
CVE-2019-16686 | Medium | 5.4 | 2019-09-27 | Dolibarr 9.0.5 has stored XSS in a User Note section to note.php. A user with no privileges can inject script to attack the admin. |
CVE-2019-16685 | Medium | 5.4 | 2019-09-27 | Dolibarr 9.0.5 has stored XSS vulnerability via a User Group Description section to card.php. A user with the "Create/modify other users, groups and permission… |
CVE-2019-16197 | Medium | 6.1 | 2019-09-16 | In htdocs/societe/card.php in Dolibarr 10.0.1, the value of the User-Agent HTTP header is copied into the HTML document as plain text between tags, leading to… |
CVE-2019-15062 | High | 8.0 | 2019-08-14 | An issue was discovered in Dolibarr 11.0.0-alpha. A user can store an IFRAME element (containing a user/card.php CSRF request) in his Linked Files settings pag… |
CVE-2019-11201 | High | 8.0 | 2019-07-29 | Dolibarr ERP/CRM 9.0.1 provides a module named website that provides for creation of public websites with a WYSIWYG editor. It was identified that the editor a… |
CVE-2019-11200 | High | 8.8 | 2019-07-29 | Dolibarr ERP/CRM 9.0.1 provides a web-based functionality that backs up the database content to a dump file. However, the application performs insufficient che… |
CVE-2019-11199 | Medium | 5.4 | 2019-07-29 | Dolibarr ERP/CRM 9.0.1 was affected by stored XSS within uploaded files. These vulnerabilities allowed the execution of a JavaScript payload each time any regu… |
CVE-2019-1010054 | High | 8.8 | 2019-07-18 | Dolibarr 7.0.0 is affected by: Cross Site Request Forgery (CSRF). The impact is: allow malitious html to change user password, disable users and disable passwo… |
CVE-2019-1010016 | Medium | 6.1 | 2019-07-15 | Dolibarr 6.0.4 is affected by: Cross Site Scripting (XSS). The impact is: Cookie stealing. The component is: htdocs/product/stats/card.php. The attack vector i… |
CVE-2018-16809 | Critical | 9.8 | 2019-03-07 | An issue was discovered in Dolibarr through 7.0.0. expensereport/card.php in the expense reports module allows SQL injection via the integer parameters qty and… |
CVE-2018-16808 | Medium | 6.1 | 2019-03-07 | An issue was discovered in Dolibarr through 7.0.0. There is Stored XSS in expensereport/card.php in the expense reports plugin via the comments parameter, or a… |