CVE-2026-89013 | High | 7.5 | 2026-09-11 | Dolibarr 23.0.4 before 24.0.1 contains an authorization bypass vulnerability that allows unauthenticated attackers to read arbitrary files through the document… |
CVE-2026-89012 | Medium | 6.5 | 2026-09-11 | Dolibarr 24.0.0 before 24.0.1 contains a case-sensitive denylist bypass vulnerability in the sqlfilters API query parameter that allows authenticated attackers… |
CVE-2026-82633 | Medium | 4.3 | 2026-08-30 | Dolibarr versions 10.0.0 before 24.0.0 fail to perform per-object authorization checks in the Users::getGroups REST API endpoint, allowing authenticated users… |
CVE-2026-81730 | High | 8.2 | 2026-08-27 | Dolibarr 9.0.0 through 23.0.4 saves inbound email attachments under the name supplied in the message's MIME headers without reducing it to a safe basename. The… |
CVE-2026-81729 | Medium | 6.5 | 2026-08-27 | Dolibarr before 23.0.4 authorizes REST API document deletion against the wrong permission. Documents::delete() in htdocs/api/class/api_documents.class.php call… |
CVE-2026-81728 | High | 8.1 | 2026-08-27 | Dolibarr before 24.0.0 contains a SQL injection in its CSV and XLSX import wizard. The wizard reads its update keys with GETPOST('updatekeys', 'array') in htdo… |
CVE-2026-77923 | Medium | 4.3 | 2026-08-24 | Dolibarr 21.0.0 before 24.0.0 contains an authorization bypass vulnerability caused by an inverted boolean condition in the private-project membership check wi… |
CVE-2026-71511 | Medium | 6.5 | 2026-08-24 | Dolibarr before 24.0.0 contains a sensitive data exposure vulnerability in the Members REST API that allows authenticated attackers with member-read rights to… |
CVE-2026-71510 | Medium | 6.5 | 2026-08-24 | Dolibarr before 24.0.0 contains a SQL injection vulnerability in the users REST API that allows authenticated attackers with user-read rights to extract sensit… |
CVE-2026-71509 | Medium | 6.5 | 2026-08-24 | Dolibarr before 24.0.0 contains an improper authorization vulnerability in the expense report REST API update endpoint that allows authenticated attackers with… |
CVE-2026-71508 | Medium | 6.5 | 2026-08-24 | Dolibarr before 24.0.0 contains an improper authorization vulnerability in the user REST API update endpoint that allows attackers with user-write rights to mo… |
CVE-2026-71507 | Medium | 6.5 | 2026-08-24 | Dolibarr before 24.0.0 contains a broken object-level authorization vulnerability in the REST API company bank account write routes that allows authenticated a… |
CVE-2026-71506 | High | 8.1 | 2026-08-24 | Dolibarr before 24.0.0 contains an improper authorization vulnerability in the payments REST API delete endpoint that allows authenticated attackers with invoi… |
CVE-2026-71505 | High | 7.1 | 2026-08-24 | Dolibarr before 24.0.0 contains a broken object-level authorization vulnerability in the REST API third-party site account write routes that allows authenticat… |
CVE-2026-71504 | High | 8.1 | 2026-08-24 | Dolibarr before 24.0.0 contains an improper authorization vulnerability in the Members REST API that allows attackers with only member-creation rights to reset… |
CVE-2026-71503 | Medium | 6.1 | 2026-08-24 | Dolibarr before 24.0.0 contains a reflected cross-site scripting vulnerability in the extra fields administration template where the type request parameter is… |
CVE-2026-78160 | Medium | 6.3 | 2026-08-24 | A vulnerability has been found in Dolibarr ERP up to 18.0.10/22.0.5/23.0.3. This issue affects some unknown processing of the file /user/note.php of the compon… |
CVE-2026-19350 | Medium | 6.3 | 2026-08-09 | A vulnerability has been found in Dolibarr ERP up to 23.0.3. Affected is the function fail of the file htdocs/takepos/invoice.php of the component TakePOS Modu… |
CVE-2026-58376 | High | 7.6 | 2026-06-30 | Dolibarr through 23.0.3, fixed in commit 14db36e, contains a sql injection vulnerability that allows authenticated API users to exfiltrate arbitrary database c… |
CVE-2026-11619 | Medium | 6.3 | 2026-06-09 | A vulnerability was identified in Dolibarr ERP CRM up to 23.0.2. The impacted element is an unknown function of the file htdocs/core/filemanagerdol/connectors/… |
CVE-2026-10215 | Medium | 4.3 | 2026-06-01 | A security vulnerability has been detected in Dolibarr ERP CRM up to 23.0.1. Impacted is the function checkUserAccessToObject of the file htdocs/holiday/class/… |
CVE-2026-10154 | Medium | 4.3 | 2026-05-31 | A vulnerability has been found in Dolibarr ERP CRM 23.0.0/23.0.1/23.0.2. The affected element is an unknown function of the file htdocs/user/messaging.php. Suc… |
CVE-2018-25357 | Critical | 9.8 | 2026-05-23 | Dolibarr ERP CRM 7.0.3 contains a remote code execution vulnerability that allows unauthenticated attackers to execute arbitrary code by injecting PHP code thr… |
CVE-2025-67486 | High | 7.2 | 2026-05-08 | Dolibarr is an enterprise resource planning (ERP) and customer relationship management (CRM) software package. Versions 22.0.2 and earlier contains an authenti… |
CVE-2026-7689 | Low | 3.7 | 2026-05-03 | A security flaw has been discovered in Dolibarr ERP CRM up to 23.0.2. This vulnerability affects the function dol_verifyHash in the library htdocs/core/lib/sec… |
CVE-2026-7688 | Medium | 5.0 | 2026-05-03 | A vulnerability was identified in Dolibarr ERP CRM up to 23.0.2. This affects the function _checkValForAPI of the file htdocs/expedition/class/expedition.class… |
CVE-2026-31019 | High | 8.8 | 2026-04-21 | In the Website module of Dolibarr ERP & CRM 22.0.4 and below, the application uses blacklist-based filtering to restrict dangerous PHP functions related to sys… |
CVE-2026-31018 | High | 8.8 | 2026-04-21 | In Dolibarr ERP & CRM <= 22.0.4, PHP code detection and editing permission enforcement in the Website module is not applied consistently to all input parameter… |
CVE-2026-23500 | Critical | 9.1 | 2026-04-17 | Dolibarr is an enterprise resource planning (ERP) and customer relationship management (CRM) software package. In versions prior to 23.0.0 , the ODT to PDF con… |
CVE-2019-25710 | High | 8.2 | 2026-04-12 | Dolibarr ERP-CRM 8.0.4 contains an SQL injection vulnerability in the rowid parameter of the admin dict.php endpoint that allows attackers to execute arbitrary… |
CVE-2026-22666 | High | 7.2 | 2026-04-07 | Dolibarr ERP/CRM versions prior to 23.0.2 contain an authenticated remote code execution vulnerability in the dol_eval_standard() function that fails to apply… |
CVE-2026-34036 | Medium | 6.5 | 2026-03-31 | Dolibarr is an enterprise resource planning (ERP) and customer relationship management (CRM) software package. In versions 22.0.4 and prior, there is a Local F… |
CVE-2019-25452 | High | 7.5 | 2026-02-22 | Dolibarr ERP/CRM 10.0.1 contains an SQL injection vulnerability in the elemid POST parameter of the viewcat.php endpoint that allows unauthenticated attackers… |
CVE-2019-25450 | High | 7.5 | 2026-02-22 | Dolibarr ERP/CRM 10.0.1 contains multiple SQL injection vulnerabilities that allow authenticated attackers to manipulate database queries by injecting SQL code… |
CVE-2020-36966 | Medium | 6.4 | 2026-01-30 | Dolibarr 11.0.3 contains a persistent cross-site scripting vulnerability in LDAP synchronization settings that allows attackers to inject malicious scripts thr… |
CVE-2021-47779 | Medium | 5.4 | 2026-01-16 | Dolibarr ERP-CRM 14.0.2 contains a stored cross-site scripting vulnerability in the ticket creation module that allows low-privilege users to inject malicious… |
CVE-2025-56588 | High | 8.8 | 2025-10-01 | Dolibarr ERP & CRM v21.0.1 were discovered to contain a remote code execution (RCE) vulnerability in the User module configuration via the computed field param… |
CVE-2024-55228 | Critical | 9.0 | 2025-01-27 | A cross-site scripting (XSS) vulnerability in the Product module of Dolibarr v21.0.0-beta allows attackers to execute arbitrary web scripts or HTMl via a craft… |
CVE-2024-55227 | Critical | 9.0 | 2025-01-27 | A cross-site scripting (XSS) vulnerability in the Events/Agenda module of Dolibarr v21.0.0-beta allows attackers to execute arbitrary web scripts or HTMl via a… |
CVE-2021-3991 | Medium | 4.3 | 2024-11-15 | An Improper Authorization vulnerability exists in Dolibarr versions prior to the 'develop' branch. A user with restricted permissions in the 'Reception' sectio… |
CVE-2024-37821 | High | 8.8 | 2024-06-18 | An arbitrary file upload vulnerability in the Upload Template function of Dolibarr ERP CRM up to v19.0.1 allows attackers to execute arbitrary code via uploadi… |
CVE-2024-5315 | Critical | 9.1 | 2024-05-24 | Vulnerabilities in Dolibarr ERP - CRM that affect version 9.0.1 and allow SQL injection. These vulnerabilities could allow a remote attacker to send a speciall… |
CVE-2024-5314 | Critical | 9.1 | 2024-05-24 | Vulnerabilities in Dolibarr ERP - CRM that affect version 9.0.1 and allow SQL injection. These vulnerabilities could allow a remote attacker to send a speciall… |
CVE-2024-31503 | High | 7.5 | 2024-04-17 | Incorrect access control in Dolibarr ERP CRM versions 19.0.0 and before, allows authenticated attackers to steal victim users' session cookies and CSRF protect… |
CVE-2024-29477 | High | 8.8 | 2024-04-03 | Lack of sanitization during Installation Process in Dolibarr ERP CRM up to version 19.0.0 allows an attacker with adjacent access to the network to execute arb… |
CVE-2024-23817 | High | 7.1 | 2024-01-25 | Dolibarr is an enterprise resource planning (ERP) and customer relationship management (CRM) software package. Version 18.0.4 has a HTML Injection vulnerabilit… |
CVE-2023-4198 | Medium | 6.5 | 2023-11-01 | Improper Access Control in Dolibarr ERP CRM <= v17.0.3 allows an unauthorized authenticated user to read a database table containing customer data |
CVE-2023-4197 | High | 7.5 | 2023-11-01 | Improper input validation in Dolibarr ERP CRM <= v18.0.1 fails to strip certain PHP code from user-supplied input when creating a Website, allowing an attacker… |
CVE-2023-5842 | Medium | 4.8 | 2023-10-30 | Cross-site Scripting (XSS) - Stored in GitHub repository dolibarr/dolibarr prior to 16.0.5. |
CVE-2023-5323 | Medium | 6.1 | 2023-10-01 | Cross-site Scripting (XSS) - Generic in GitHub repository dolibarr/dolibarr prior to 18.0. |
CVE-2023-38888 | Critical | 9.6 | 2023-09-20 | Cross Site Scripting vulnerability in Dolibarr ERP CRM v.17.0.1 and before allows a remote attacker to obtain sensitive information and execute arbitrary code… |
CVE-2023-38887 | High | 8.8 | 2023-09-20 | File Upload vulnerability in Dolibarr ERP CRM v.17.0.1 and before allows a remote attacker to execute arbitrary code and obtain sensitive information via the e… |
CVE-2023-38886 | High | 7.2 | 2023-09-20 | An issue in Dolibarr ERP CRM v.17.0.1 and before allows a remote privileged attacker to execute arbitrary code via a crafted command/script. |
CVE-2023-33568 | High | 7.5 | 2023-06-13 | An issue in Dolibarr 16 before 16.0.5 allows unauthenticated attackers to perform a database dump and access a company's entire customer file, prospects, suppl… |
CVE-2023-30253 | High | 8.8 | 2023-05-29 | Dolibarr before 17.0.1 allows remote code execution by an authenticated user via an uppercase manipulation: <?PHP instead of <?php in injected data. |
CVE-2022-4093 | Critical | 9.8 | 2022-11-21 | SQL injection attacks can result in unauthorized access to sensitive data, such as passwords, credit card details, or personal user information. Many high-prof… |
CVE-2022-43138 | Critical | 9.8 | 2022-11-17 | Dolibarr Open Source ERP & CRM for Business before v14.0.1 allows attackers to escalate privileges via a crafted API. |
CVE-2022-40871 | Critical | 9.8 | 2022-10-12 | Dolibarr ERP & CRM <=15.0.3 is vulnerable to Eval injection. By default, any administrator can be added to the installation page of dolibarr, and if successful… |
CVE-2022-2060 | Medium | 5.4 | 2022-06-13 | Cross-site Scripting (XSS) - Stored in GitHub repository dolibarr/dolibarr prior to 16.0. |
CVE-2022-30875 | Medium | 6.1 | 2022-06-08 | Dolibarr 12.0.5 is vulnerable to Cross Site Scripting (XSS) via Sql Error Page. |
CVE-2021-37517 | High | 7.5 | 2022-03-31 | An Access Control vulnerability exists in Dolibarr ERP/CRM 13.0.2, fixed version is 14.0.0,in the forgot-password function becuase the application allows email… |
CVE-2021-36625 | High | 8.8 | 2022-03-31 | An SQL Injection vulnerability exists in Dolibarr ERP/CRM 13.0.2 (fixed version is 14.0.0) via a POST request to the country_id parameter in an UPDATE statemen… |
CVE-2022-0819 | High | 8.8 | 2022-03-02 | Code Injection in GitHub repository dolibarr/dolibarr prior to 15.0.1. |
CVE-2022-0746 | Medium | 4.3 | 2022-02-25 | Business Logic Errors in GitHub repository dolibarr/dolibarr prior to 16.0. |
CVE-2022-0731 | Medium | 6.5 | 2022-02-23 | Improper Access Control (IDOR) in GitHub repository dolibarr/dolibarr prior to 16.0. |
CVE-2022-0414 | Medium | 4.3 | 2022-01-31 | Improper Validation of Specified Quantity in Input in Packagist dolibarr/dolibarr prior to 16.0. |
CVE-2022-0224 | Critical | 9.8 | 2022-01-14 | dolibarr is vulnerable to Improper Neutralization of Special Elements used in an SQL Command |
CVE-2022-0174 | Medium | 4.3 | 2022-01-10 | Improper Validation of Specified Quantity in Input vulnerability in dolibarr dolibarr/dolibarr. |
CVE-2022-22293 | Medium | 5.4 | 2022-01-02 | admin/limits.php in Dolibarr 7.0.2 allows HTML injection, as demonstrated by the MAIN_MAX_DECIMALS_TOT parameter. |
CVE-2021-42220 | Medium | 5.4 | 2021-12-15 | A Cross Site Scripting (XSS) vulnerability exists in Dolibarr before 14.0.3 via the ticket creation flow. Exploitation requires that an admin copies the payloa… |
CVE-2021-33816 | Critical | 9.8 | 2021-11-10 | The website builder module in Dolibarr 13.0.2 allows remote PHP code execution because of an incomplete protection mechanism in which system, exec, and shell_e… |
CVE-2021-33618 | Medium | 6.1 | 2021-11-10 | Dolibarr ERP and CRM 13.0.2 allows XSS via object details, as demonstrated by > and < characters in the onpointermove attribute of a BODY element to the user-m… |
CVE-2021-25957 | High | 8.8 | 2021-08-17 | In “Dolibarr” application, v2.8.1 to v13.0.2 are vulnerable to account takeover via password reset functionality. A low privileged attacker can reset the passw… |
CVE-2021-25956 | Medium | 4.7 | 2021-08-17 | In “Dolibarr” application, v3.3.beta1_20121221 to v13.0.2 have “Modify” access for admin level users to change other user’s details but fails to validate alrea… |
CVE-2021-25955 | Critical | 9.0 | 2021-08-15 | In “Dolibarr ERP CRM”, WYSIWYG Editor module, v2.8.1 to v13.0.2 are affected by a stored XSS vulnerability that allows low privileged application users to stor… |
CVE-2021-25954 | Medium | 4.3 | 2021-08-09 | In “Dolibarr” application, 2.8.1 to 13.0.4 don’t restrict or incorrectly restricts access to a resource from an unauthorized actor. A low privileged attacker c… |
CVE-2020-35136 | High | 7.2 | 2020-12-23 | Dolibarr 12.0.3 is vulnerable to authenticated Remote Code Execution. An attacker who has the access the admin dashboard can manipulate the backup function by… |
CVE-2020-14209 | High | 8.8 | 2020-09-02 | Dolibarr before 11.0.5 allows low-privilege users to upload files of dangerous types, leading to arbitrary code execution. This occurs because .pht and .phar f… |
CVE-2020-13828 | Medium | 5.4 | 2020-08-31 | Dolibarr 11.0.4 is affected by multiple stored Cross-Site Scripting (XSS) vulnerabilities that could allow remote authenticated attackers to inject arbitrary w… |
CVE-2020-14201 | Medium | 6.5 | 2020-08-21 | Dolibarr CRM before 11.0.5 allows privilege escalation. This could allow remote authenticated attackers to upload arbitrary files via societe/document.php in w… |
CVE-2020-14475 | Medium | 6.1 | 2020-06-19 | A reflected cross-site scripting (XSS) vulnerability in Dolibarr 11.0.3 allows remote attackers to inject arbitrary web script or HTML into public/notice.php (… |
CVE-2020-14443 | High | 8.8 | 2020-06-18 | A SQL injection vulnerability in accountancy/customer/card.php in Dolibarr 11.0.3 allows remote authenticated users to execute arbitrary SQL commands via the i… |
CVE-2020-13240 | Medium | 5.4 | 2020-05-20 | The DMS/ECM module in Dolibarr 11.0.4 allows users with the 'Setup documents directories' permission to rename uploaded files to have insecure file extensions… |
CVE-2020-13239 | Medium | 5.4 | 2020-05-20 | The DMS/ECM module in Dolibarr 11.0.4 renders user-uploaded .html files in the browser when the attachment parameter is removed from the direct download link… |
CVE-2020-13094 | Medium | 5.4 | 2020-05-18 | Dolibarr before 11.0.4 allows XSS. |
CVE-2020-12669 | High | 8.8 | 2020-05-06 | core/get_menudiv.php in Dolibarr before 11.0.4 allows remote authenticated attackers to bypass intended access restrictions via a non-alphanumeric menu paramet… |
CVE-2020-11825 | High | 8.8 | 2020-04-16 | In Dolibarr 10.0.6, forms are protected with a CSRF token against CSRF attacks. The problem is any CSRF token in any user's session can be used in another user… |
CVE-2020-11823 | Medium | 5.4 | 2020-04-16 | In Dolibarr 10.0.6, if USER_LOGIN_FAILED is active, there is a stored XSS vulnerability on the admin tools --> audit page. This may lead to stealing of the adm… |
CVE-2019-19212 | Critical | 9.8 | 2020-03-16 | Dolibarr ERP/CRM 3.0 through 10.0.3 allows XSS via the qty parameter to product/fournisseurs.php (product price screen). |
CVE-2019-19211 | Medium | 6.1 | 2020-03-16 | Dolibarr ERP/CRM before 10.0.3 has an Insufficient Filtering issue that can lead to user/card.php XSS. |
CVE-2019-19210 | Medium | 5.4 | 2020-03-16 | Dolibarr ERP/CRM before 10.0.3 allows XSS because uploaded HTML documents are served as text/html despite being renamed to .noexe files. |
CVE-2019-19209 | High | 7.5 | 2020-03-16 | Dolibarr ERP/CRM before 10.0.3 allows SQL Injection. |
CVE-2020-9016 | Medium | 5.4 | 2020-02-16 | Dolibarr 11.0 allows XSS via the joinfiles, topic, or code parameter, or the HTTP Referer header. |
CVE-2020-7996 | Medium | 6.1 | 2020-01-26 | htdocs/user/passwordforgotten.php in Dolibarr 10.0.6 allows XSS via the Referer HTTP header. |
CVE-2020-7995 | Critical | 9.8 | 2020-01-26 | The htdocs/index.php?mainmenu=home login page in Dolibarr 10.0.6 allows an unlimited rate of failed authentication attempts. |
CVE-2020-7994 | Medium | 6.1 | 2020-01-26 | Multiple cross-site scripting (XSS) vulnerabilities in Dolibarr 10.0.6 allow remote attackers to inject arbitrary web script or HTML via the (1) label[libelle]… |
CVE-2019-19206 | Medium | 5.4 | 2019-11-26 | Dolibarr CRM/ERP 10.0.3 allows viewimage.php?file= Stored XSS due to JavaScript execution in an SVG image for a profile picture. |
CVE-2013-2093 | Critical | 9.8 | 2019-11-20 | Dolibarr ERP/CRM 3.3.1 does not properly validate user input in viewimage.php and barcode.lib.php which allows remote attackers to execute arbitrary commands. |
CVE-2013-2092 | Medium | 6.1 | 2019-11-20 | Cross-site Scripting (XSS) in Dolibarr ERP/CRM 3.3.1 allows remote attackers to inject arbitrary web script or HTML in functions.lib.php. |
CVE-2013-2091 | Critical | 9.8 | 2019-11-20 | SQL injection vulnerability in Dolibarr ERP/CRM 3.3.1 allows remote attackers to execute arbitrary SQL commands via the 'pays' parameter in fiche.php. |