CVEs we hold for Dolibarr
Records whose assigning authority named Dolibarr as the affected vendor. Newest identifiers first, capped at 200.
CVE-2026-89013Dolibarr 23.0.4 < 24.0.1 Authorization Bypass via hashp Parameter in document.phpDolibarr CVE-2026-89012Dolibarr 24.0.0 < 24.0.1 SQL Filter Denylist Bypass via sqlfilters ParameterDolibarr CVE-2026-85401Dolibarr Legacy File Manager config.inc.php access controln/a Dolibarr CVE-2026-82633Dolibarr 10.0.0 before 24.0.0 Missing Authorization on REST Users Groups Endpointdolibarr CVE-2026-81730Dolibarr 9.0.0 through 23.0.4 Path Traversal via EmailCollector Attachment Filenamedolibarr CVE-2026-81729Dolibarr before 23.0.4 Incorrect Authorization on REST API Document Deletiondolibarr CVE-2026-81728Dolibarr before 24.0.0 SQL Injection via the CSV and XLSX Import Update Keysdolibarr CVE-2026-78160Dolibarr ERP User Notes note.php authorizationDolibarr ERP CVE-2026-77923Dolibarr 21.0.0 < 24.0.0 Authorization Bypass via clonetasks Mass Actiondolibarr CVE-2026-77686Dolibarr Account card.php improper authorizationn/a Dolibarr CVE-2026-7689Dolibarr ERP CRM Online Signature security.lib.php dol_verifyHash signature verificationDolibarr ERP CRM CVE-2026-7688Dolibarr ERP CRM Shipments API Endpoint expedition.class.php _checkValForAPI sql injectionDolibarr ERP CRM CVE-2026-71511Dolibarr < 24.0.0 Members REST API Sensitive Data Exposure via Member Endpointsdolibarr CVE-2026-71510Dolibarr < 24.0.0 Users REST API SQL Injection via filter parameterdolibarr CVE-2026-71509Dolibarr < 24.0.0 Expense Report REST API Improper Authorization via Update Endpointdolibarr CVE-2026-71508Dolibarr < 24.0.0 REST API Improper Authorization via User Update Endpointdolibarr CVE-2026-71507Dolibarr < 24.0.0 REST API Broken Object-Level Authorization via Bank Account Routesdolibarr CVE-2026-71506Dolibarr < 24.0.0 Payments REST API Improper Authorization via Delete Endpointdolibarr CVE-2026-71505Dolibarr < 24.0.0 REST API Broken Object-Level Authorization via Third-Party Write Routedolibarr CVE-2026-71504Dolibarr < 24.0.0 Members REST API Improper Authorization via Password Resetdolibarr CVE-2026-71503Dolibarr < 24.0.0 Reflected XSS via Extra Fields Administration Templatedolibarr CVE-2026-58376Dolibarr - SQL Injection via sqlfilters Parameter in Multiple REST API List Endpointsdolibarr CVE-2026-34036Dolibarr Core Discloses Sensitive Data via Authenticated Local File Inclusion in selectobject.phpdolibarr CVE-2026-23500Dolibarr: OS Command Injection (RCE) via MAIN_ODT_AS_PDF configurationdolibarr CVE-2026-22666Dolibarr ERP/CRM < 23.0.2 Authenticated RCE via dol_eval_standard()Dolibarr ERP/CRM CVE-2026-19930Dolibarr User Cloning card.php ldap injectionn/a Dolibarr CVE-2026-19350Dolibarr ERP TakePOS invoice.php fail authorizationDolibarr ERP CVE-2026-11619Dolibarr ERP CRM Legacy Filemanager config.inc.php improper authorizationDolibarr ERP CRM CVE-2026-10215Dolibarr ERP CRM Leave Request REST API api_holidays.class.php checkUserAccessToObject improper authorizationDolibarr ERP CRM CVE-2026-10154Dolibarr ERP CRM messaging.php authorizationDolibarr ERP CRM CVE-2025-67486Dolibarr has an Authenticated Remote Code Execution via eval() injection in user extrafieldsdolibarr CVE-2024-5315Multiple vulnerabilities in DOLIBARR's ERP CMSDolibarr ERP CMS CVE-2024-5314Multiple vulnerabilities in DOLIBARR's ERP CMSDolibarr ERP CMS CVE-2024-23817Dolibarr Application Home Page HTML injection vulnerabilitydolibarr CVE-2023-5842Cross-site Scripting (XSS) - Stored in dolibarr/dolibarrdolibarr/dolibarr CVE-2023-5323Cross-site Scripting (XSS) - Generic in dolibarr/dolibarrdolibarr/dolibarr CVE-2023-4198Dolibarr ERP CRM (<= 17.0.3) Improper Access ControlDolibarr ERP CRM CVE-2023-4197Dolibarr ERP CRM (<= 18.0.1) Improper Input Sanitization Authenticated RCEDolibarr ERP CRM CVE-2022-4766dolibarr_project_timesheet Form cross-site request forgeryn/a dolibarr_project_timesheet CVE-2022-2060Cross-site Scripting (XSS) - Stored in dolibarr/dolibarrdolibarr/dolibarr CVE-2022-0819Code Injection in dolibarr/dolibarrdolibarr/dolibarr CVE-2022-0746Business Logic Errors in dolibarr/dolibarrdolibarr/dolibarr CVE-2022-0731Improper Access Control (IDOR) in dolibarr/dolibarrdolibarr/dolibarr CVE-2022-0414Improper Validation of Specified Quantity in Input in dolibarr/dolibarrdolibarr/dolibarr CVE-2022-0174Improper Validation of Specified Quantity in Input in dolibarr/dolibarrdolibarr/dolibarr CVE-2021-47779Dolibarr ERP-CRM 14.0.2 - Stored Cross-Site Scripting (XSS) / Privilege EscalationDolibarr CRM CVE-2021-3991Improper Authorization in dolibarr/dolibarrdolibarr/dolibarr CVE-2021-25957Account Takeover in "Dolibarr" via Password Reset Functionalitydolibarr CVE-2021-25956Improper User Access Control in "Dolibarr" Leads to Account Takeoverdolibarr CVE-2021-25955Stored XSS in “Dolibarr” leads to privilege escalationdolibarr CVE-2020-36966Dolibarr 11.0.3 - 'ldap.php' - Persistent Cross-Site ScriptingDolibarr CVE-2019-25710Dolibarr ERP-CRM 8.0.4 SQL Injection via rowid ParameterDolibarr ERP-CRM CVE-2019-25452Dolibarr ERP/CRM 10.0.1 SQL Injection via elemidDolibarr ERP/CRM CVE-2019-25450Dolibarr ERP/CRM 10.0.1 SQL Injection via card.phpDolibarr ERP/CRM CVE-2018-25357Dolibarr ERP CRM 7.0.3 Remote Code Execution via install/step1.phpDolibarr ERP CRM CVE-2012-10059Dolibarr ERP/CRM Post-Auth OS Command InjectionDolibarr Project ERP/CRM 64 records, read from the index as it stood on 20 Sep 2026. Every row opens the record it names, and every value on that record opens its own receipt.
Everything on this page is free. Public data. Withholding it protects nothing.