EUVD-2026-26827Severity by source
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
6DescriptionCVE.org
A security flaw has been discovered in Dolibarr ERP CRM up to 23.0.2. This vulnerability affects the function dol_verifyHash in the library htdocs/core/lib/security.lib.php of the component Online Signature Module. The manipulation results in improper verification of cryptographic signature. The attack may be performed from remote. Attacks of this nature are highly complex. It is stated that the exploitability is difficult. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
AnalysisAI
Improper cryptographic signature verification in Dolibarr ERP CRM up to version 23.0.2 allows remote attackers to bypass signature validation in the Online Signature Module, potentially forging or manipulating signed transactions. The vulnerability affects the dol_verifyHash function and has been publicly disclosed with exploit code available, though exploitation requires high technical complexity and is not confirmed as actively exploited in production environments.
Technical ContextAI
The vulnerability resides in the dol_verifyHash function within htdocs/core/lib/security.lib.php, which is responsible for verifying cryptographic signatures in Dolibarr's Online Signature Module. CWE-347 (Improper Verification of Cryptographic Signature) indicates the root cause: the hash verification logic fails to properly validate signatures, potentially allowing attackers to forge valid signatures or bypass signature checks. This is commonly seen in JWT (JSON Web Token) implementations or custom signature schemes where the verification algorithm is weak, uses insecure comparison operators, or ignores cryptographic best practices. The attack vector is network-based and requires no authentication or user interaction, but the high complexity (AC:H) suggests the exploit requires deep understanding of the signature scheme or specific conditions to trigger.
RemediationAI
Upgrade Dolibarr ERP CRM to a version released after 23.0.2 that includes a fix for the dol_verifyHash function. No specific patched version number is provided in available data; contact Dolibarr support or check the official repository (https://github.com/Dolibarr/dolibarr) for the latest stable release. Until patching is possible, implement compensating controls by disabling the Online Signature Module if it is not essential to business operations, or restrict access to the signature verification endpoints to trusted internal networks only via firewall rules or WAF policies. If the module must remain enabled, implement additional server-side validation of signed documents through external cryptographic libraries and mandate manual verification of critical transactions. Monitor logs for unusual signature validation failures or attempts to process multiple signatures in rapid succession, which may indicate exploitation attempts. Note that these compensating controls reduce functionality and should be treated as temporary measures pending vendor patch availability.
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
NetAlertX (formerly PiAlert) versions 23.01.14 through 24.x before 24.10.12 allow unauthenticated command injection thro
The GiveWP - Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today