Dolibarr
Monthly
Authenticated Dolibarr administrators can run arbitrary operating-system commands as the web server user through the database export tool (htdocs/admin/tools/export.php) in every release before 24.0.0, because the restrict_os_commands allowlist can be bypassed by injecting a crafted mysqldump value. The attacker must already hold administrator rights (CVSS 4.0 base 8.6; assessed CVSS 3.1 AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) and exploitation is confined to the web server user's privileges, so there is no scope change to other systems; there is no CISA KEV entry and no public exploit identified at time of analysis, and the vendor rates the fix as this-week rather than emergency priority.
SQL injection in Dolibarr ERP CRM 19.0.0 through 23.0.3 (fixed in 23.0.4) allows an authenticated REST API user holding only the low-privilege societe/creer (third-party creation) permission to break out of the unescaped 'type' value when creating a company bank account. The injected payload reaches an unescaped string concatenation in CompanyBankAccount::create() and can be used in time-based blind subqueries to read password hashes and API keys from the database. Exploitation requires the REST API to be enabled and reachable plus valid credentials with that specific permission, so this is a conditional, credentialed attack rather than a drive-by one; no public exploit code has been identified at time of analysis and the vulnerability is not in CISA KEV.
Authenticated Dolibarr users with privileges to write extrafields, export configurations, or blocked log entries can trigger PHP object injection in versions before 23.0.4, potentially leading to code execution or file manipulation if a suitable gadget chain exists. The flaw resides in jsonOrUnserialize() and requires the stored payload to be non-JSON so that unserialize() runs without class restrictions; exploitation is high-complexity and no public exploit has been identified. Upgrading to 23.0.4 or later is the only complete fix.
Password hash extraction from any Dolibarr 24.0.0 user account, including administrators, is possible for authenticated low-privileged users via a case-sensitivity mismatch in the sqlfilters API parameter denylist. The PHP guard in dolForgeSQLCriteriaCallback() performs case-sensitive string matching against forbidden field names, while the underlying database resolves column names case-insensitively, allowing bypasses using uppercase variants such as PASSWORD instead of password. By submitting prefix-matching predicates as boolean oracle queries, an attacker can extract full credential hashes character-by-character without elevated privileges. No public exploit code has been identified at time of analysis; a patch commit is available upstream.
Path traversal via unsanitized MIME attachment filenames in Dolibarr's EmailCollector module allows any email sender to write attacker-controlled files outside the intended attachment directory, affecting versions 9.0.0 through 23.0.4. Because the EmailCollector is designed to ingest mail from unauthenticated external senders - such as a support or ticket inbox - no Dolibarr account is required to exploit this flaw. On hardened deployments with a read-only htdocs tree, the attacker can corrupt or forge documents belonging to other objects; on installations where htdocs is writable, the same write primitive reaches web-executable PHP paths, enabling remote code execution. No public exploit identified at time of analysis.
Incorrect authorization in Dolibarr's REST API before version 23.0.4 allows authenticated users holding only read-level module permissions to permanently delete documents via the DELETE /api/index.php/documents endpoint. The flaw in Documents::delete() at htdocs/api/class/api_documents.class.php passes the mode argument 'read' rather than 'write' to dol_check_secure_access_document(), meaning any API account with societe:lire, facture:lire, or equivalent read-only grants can irrecoverably destroy third-party files, invoices, orders, proposals, project files, and generated PDFs. No public exploit has been identified at time of analysis, but the corrective one-line commit diff is publicly visible on GitHub, making the flaw trivial to weaponize for any holder of low-privilege API credentials.
SQL injection in Dolibarr's CSV and XLSX import wizard (all versions before 24.0.0, including the most recent 23.0.4 stable release) allows an authenticated user holding the import permission to inject arbitrary SQL through the unsanitized updatekeys POST parameter. A crafted UNION SELECT payload simultaneously exfiltrates content from any database table the application account can read and hijacks the WHERE clause of the subsequent UPDATE to redirect which row is overwritten; for category link tables the raw filter array is spliced directly into UPDATE statements. No public exploit has been identified at time of analysis, and this CVE does not appear in the CISA KEV catalog.
Dolibarr's Members REST API before version 24.0.0 exposes bcrypt password hash verifiers to any authenticated user holding member-read rights, enabling offline password cracking attacks against member accounts. Both the member list and individual member detail endpoints return the crypted password verifier field because neither the base API serializer nor the Members API class applies field-level filtering to strip credential material from responses. A public proof-of-concept exists; this is not confirmed as actively exploited via CISA KEV, but the low access bar combined with exposed credential hashes and available exploit code makes this a genuine remediation priority for organizations running affected versions.
SQL injection in Dolibarr's users REST API (all versions before 24.0.0) allows authenticated users holding only user-read rights to exfiltrate sensitive database columns - including salary figures and password verifier hashes - that the API is explicitly designed to withhold from normal responses. The injection path targets unsanitized filter parameters concatenated directly into SQL WHERE clauses with no column-level access gating, enabling blind binary search on numeric fields and LIKE prefix iteration on string fields; raw database error messages in the same endpoint additionally leak internal column names. A publicly available exploit writeup documents the full technique (codeant.ai, VulnCheck); no CISA KEV listing is recorded at time of analysis.
Improper authorization in Dolibarr's expense report REST API update endpoint allows authenticated users with only expense-creation rights to self-approve their own expense reports by directly manipulating workflow state fields, including approval status and approver identity. All Dolibarr versions before 24.0.0 are affected; a publicly available proof-of-concept exploit demonstrates the bypass. While not listed in CISA KEV, the publicly available exploit and the financial integrity impact - including forged audit records and missing approval timestamps - make this a meaningful risk for organizations running Dolibarr for financial operations.
Dolibarr's REST API user-update endpoint permits any low-privileged account holding user-write rights to overwrite payroll fields - salary, bonus, hourly rate, daily rate, and weekly hours - for arbitrary user records, bypassing intended payroll-role access controls. All Dolibarr versions before 24.0.0 are affected due to an incomplete field denylist that fails to exclude payroll columns from mass-assignment in the API layer. A publicly available proof-of-concept exploit exists; no confirmed active exploitation has been recorded in CISA KEV at the time of analysis, but vendor-released patch version 24.0.0 is available.
Broken object-level authorization (BOLA) in Dolibarr's REST API bank account write routes permits any authenticated user holding third-party creation rights to overwrite bank account details - including IBANs - for any company in the system, regardless of whether they have read access to that company. When SEPA credit-transfer files are subsequently regenerated from the tampered records, outgoing supplier payments are silently redirected to attacker-controlled accounts, enabling financial fraud at scale. Publicly available exploit code exists per VulnCheck and codeant.ai research; the vulnerability is not yet listed in CISA KEV but the financial impact potential elevates real-world priority above the 7.1 CVSS score alone suggests.
Incorrect authorization in Dolibarr's payments REST API delete endpoint exposes all payment records to deletion by any authenticated user holding invoice-deletion rights, regardless of whether they possess payment-issuance rights. All Dolibarr installations prior to version 24.0.0 are affected. Exploitation results in permanent removal of payment records, zeroing of paid invoice amounts, and corruption of accounting exports - a high-integrity, high-availability financial data loss. Publicly available exploit code exists, lowering the attack barrier; active exploitation has not been confirmed by CISA KEV at time of analysis.
Broken object-level authorization (BOLA) in Dolibarr's REST API write routes for third-party site accounts allows any authenticated user holding third-party creation rights to overwrite the WebPortal password of any company in the system, regardless of ownership. After replacing the password, the attacker can log into the victim company's WebPortal and access its invoice data; the write endpoint also returns the victim's previous password verifier, enabling potential offline credential attacks. A public proof-of-concept is available; no confirmed active exploitation (CISA KEV) at time of analysis, but the low attack complexity and available PoC make this a genuine priority for all pre-24.0.0 deployments.
Improper authorization in Dolibarr's Members REST API (all versions before 24.0.0) allows any authenticated user holding member-creation rights to overwrite the password of any system account - including the administrator - without possessing password-change permissions. The attacker supplies an arbitrary user identifier and replacement password in the API request body, immediately gaining control of the target account and locking out its legitimate holder. A publicly available proof-of-concept exists; no active exploitation has been confirmed in CISA KEV at the time of analysis.
SQL injection in Dolibarr ERP/CRM through version 23.0.3 lets authenticated REST API users exfiltrate arbitrary database contents - including password hashes and API keys - by abusing the sqlfilters parameter on the setup dictionary and multicurrencies list endpoints. The flawed filter only checked for balanced parentheses and rewrote matched triplets, so an appended UNION SELECT placed outside the expected pattern was concatenated into the WHERE clause unmodified. Publicly available exploit code exists and a vendor fix has been committed; the issue is not listed in CISA KEV.
Command injection in Dolibarr ERP/CRM versions before 23.0.0 allows authenticated administrators to execute arbitrary operating system commands during ODT-to-PDF template conversion. The vulnerability stems from unsanitized concatenation of the MAIN_ODT_AS_PDF configuration constant into shell commands in odf.php. Exploitation requires administrative privileges (PR:H) but can be executed remotely (AV:N) with low complexity (AC:L), resulting in full system compromise as the web server user. Fixed in version 23.0.0. EPSS data not available; no public exploit identified at time of analysis.
Remote code execution in Dolibarr ERP/CRM versions prior to 23.0.2 allows authenticated administrators to execute arbitrary system commands by exploiting inadequate input validation in the dol_eval_standard() function. The vulnerability enables attackers to bypass security controls using PHP dynamic callable syntax through computed extrafields or other evaluation paths. With a CVSS score of 7.2 and publicly available exploit code documented by Jiva Security, this represents an elevated risk for organizations running unpatched Dolibarr instances, though exploitation requires high-privilege administrator access (CVSS:3.1/PR:H), limiting the attack surface to insider threats or compromised admin accounts.
Dolibarr before 17.0.1 allows remote code execution by an authenticated user via an uppercase manipulation: <?PHP instead of <?php in injected data. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Unauthenticated information disclosure in Dolibarr ERP/CRM before 24.0.2 lets remote users read unpublished draft job positions through the public recruitment script htdocs/public/recruitment/view.php. Exposure is confined to deployments that have enabled the optional RECRUITMENT_ENABLE_PUBLIC_INTERFACE setting; there, walking sequential provisional 'ref' values reveals job titles, descriptions, salary budgets and recruiter names and emails, with confidentiality-only impact and no effect on integrity or availability. No public exploit has been identified at time of analysis, and the vendor patch is available in 24.0.2 (fixes in pull request 41108).
Dolibarr up to and including 23.0.2 uses a weakened Content-Security-Policy on its document-serving endpoints: htdocs/document.php and htdocs/viewimage.php define MAIN_SECURITY_FORCECSP with form-action 'self' instead of the stricter form-action 'none'. This is a defense-in-depth protection-mechanism failure, not a directly exploitable injection flaw; meaningful abuse generally requires a separate content-injection primitive to place a malicious form into content served from those endpoints, which constrains real-world exploitability. The CVSS vector requires authenticated access (PR:L) and no user interaction, and the issue is assessed as moderate-to-low priority; no public exploit was identified at time of analysis, and upgrading to 24.0.0 resolves it.
Authenticated Dolibarr ERP CRM users who hold only read permission on a record can persistently modify that record's extrafield values in all versions before 24.0.2, because the AJAX endpoint htdocs/core/ajax/updateextrafield.php calls restrictedArea() without the 'write' mode flag and therefore enforces only read access. Exploitation requires a valid authenticated session plus read visibility of the target object (third party, product, member, project or contact) and a crafted POST supplying objectType, objectId, field and value; no victim interaction is needed, but the flaw is confined to integrity of extrafield data (CVSS 4.0 5.3, PR:L, I:L) with no confidentiality or availability impact. No public exploit code has been identified at time of analysis and the issue is not in CISA KEV, so this is a moderate-risk authorization weakness rather than an emergency; vendor patch data confirms a fix is available in 24.0.2.
Improper access control in Dolibarr's Legacy File Manager connector allows any authenticated user - regardless of assigned module permissions - to access and interact with the medias directory. Affected versions span up to 21.0.4, 22.0.5, and 23.0.3. A public exploit exists via GitHub issue #38963, and the patch commit (ef6631e9bd5ec4b8cec0e88f1796d3d10dad02ec) confirms that the vulnerable file (htdocs/core/filemanagerdol/connectors/php/config.inc.php) entirely lacked an authorization gate, meaning even zero-privilege authenticated accounts could reach the file manager. No active exploitation (CISA KEV) has been confirmed.
Insecure Direct Object Reference in Dolibarr's Users::getGroups REST API endpoint allows any authenticated user to read group memberships of arbitrary users across tenant boundaries without authorization. Versions 10.0.0 through 23.x omit the per-object access check in GET /users/{id}/groups, exposing group names, entity associations, and private notes to any API credential holder. Fixed in 24.0.0; no public exploit or CISA KEV listing identified at time of analysis.
Authorization bypass in Dolibarr ERP versions 21.0.0 through 23.x allows authenticated users holding project-creation permission to clone tasks into private projects they are not authorized to access. The flaw is an inverted boolean logic error in the clonetasks mass action handler - `!in_array()` is used where `in_array()` is required, causing the private-project membership check to pass precisely for unauthorized users and fail for authorized ones. No public exploit code exists and this vulnerability is not listed in CISA KEV; however, the low attack complexity (AC:L) means any authenticated user with project-creation rights can trivially abuse the flaw against any private project in the same Dolibarr instance.
Reflected XSS in Dolibarr's extra fields administration template (all versions before 24.0.0) allows an unauthenticated attacker to execute arbitrary JavaScript in an authenticated administrator's browser session by delivering a crafted URL containing a malicious `type` parameter. The parameter is echoed without JavaScript-context encoding directly into an inline script block, and no Content-Security-Policy header is present to block the execution. Successful exploitation enables the attacker to create a persistent backdoor administrator account, constituting a full application takeover with no KEV listing but publicly available exploit code confirmed by VulnCheck.
Authorization bypass in Dolibarr ERP up to versions 18.0.10, 22.0.5, and 23.0.3 allows any low-privileged authenticated user to read or overwrite another user's private notes by manipulating the numeric `id` parameter in `/user/note.php`. The root cause (CWE-639 - Authorization Bypass Through User-Controlled Key) is a missing identity check before the permission evaluation: all requests were evaluated under the caller's self-write right rather than distinguishing whether the target user matched the caller. A proof-of-concept exists (CVSS 4.0 E:P), though no active exploitation has been confirmed via CISA KEV. Patches are available in versions 23.0.4 and 24.0.0.
LDAP injection in Dolibarr's User Cloning component (htdocs/user/card.php) through version 23.0.3 allows authenticated remote attackers to manipulate LDAP query logic by crafting the user ID argument. Any valid Dolibarr user with access to the User Cloning feature can exploit this without additional privileges or user interaction. A public exploit has been released on Google Drive, substantially lowering the barrier for abuse; no active exploitation is confirmed in CISA KEV at time of analysis.
Missing authorization in Dolibarr ERP's TakePOS module through version 23.0.3 permits authenticated users with only basic cashier-level access to perform sensitive invoice operations - deleting line items, adjusting quantities, modifying prices, and applying discounts - that require the elevated `editlines` permission. The flaw exists because htdocs/takepos/invoice.php processes these actions without verifying the caller holds the `takepos.editlines` right, creating a privilege boundary bypass within the POS subsystem. An upstream patch commit (8992ce8704da947b6abe7b65a6fe59aed736bb81) is available; no CISA KEV listing and no public exploit code identified at time of analysis.
Horizontal privilege escalation in Dolibarr ERP CRM through version 23.0.1 permits any authenticated low-privilege user to read other users' leave request records via the Leave Request REST API, with a publicly available proof-of-concept confirming exploitability. The flaw in `checkUserAccessToObject` within `api_holidays.class.php` (CWE-285, Improper Authorization) arises because the access control helper receives only an integer object ID rather than the full object, causing ownership validation to fail silently and return another user's confidential HR data. No active exploitation is confirmed in CISA KEV, but the public POC and low attack complexity make this a realistic insider or multi-tenant threat requiring prompt patching.
Insecure Direct Object Reference in Dolibarr ERP CRM 23.0.0-23.0.2 allows any authenticated low-privilege user to read another user's messaging records by manipulating the `id` parameter in `htdocs/user/messaging.php`. The commit diff confirms the endpoint performed zero ownership or permission validation before serving messaging data - any valid session could enumerate other users' messages by cycling numeric IDs. No public exploit code has been identified and this CVE does not appear in CISA KEV, but the vulnerability is trivially exploitable given its low complexity and minimal authentication barrier.
Dolibarr ERP CRM 7.0.3 contains a remote code evaluation vulnerability that allows unauthenticated attackers to execute arbitrary code by injecting PHP code through the db_name parameter. Rated critical severity (CVSS 9.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Remote code execution in Dolibarr ERP/CRM versions ≤22.0.2 allows authenticated administrators to execute arbitrary PHP code by injecting malicious payloads into the 'computed value' field of user extrafields, which are passed unsanitized to PHP's eval() function. No vendor patch exists at time of analysis (zero-day status), but exploitation requires high-privilege administrator access, limiting immediate risk to environments with compromised admin accounts or malicious insiders. EPSS data unavailable; not listed in CISA KEV, indicating no confirmed widespread exploitation despite public technical disclosure.
Improper cryptographic signature verification in Dolibarr ERP CRM up to version 23.0.2 allows remote attackers to bypass signature validation in the Online Signature Module, potentially forging or manipulating signed transactions. The vulnerability affects the dol_verifyHash function and has been publicly disclosed with exploit code available, though exploitation requires high technical complexity and is not confirmed as actively exploited in production environments.
SQL injection in Dolibarr ERP CRM up to version 23.0.2 allows authenticated remote attackers to execute arbitrary SQL queries via the fields parameter in the Shipments API Endpoint (_checkValForAPI function). Exploitation requires high attack complexity and authenticated access, with publicly available exploit code confirmed but no active exploitation reported in CISA KEV at time of analysis.
Dolibarr ERP-CRM 8.0.4 contains an SQL injection vulnerability in the rowid parameter of the admin dict.php endpoint that allows attackers to execute arbitrary SQL queries. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Dolibarr ERP/CRM 10.0.1 contains an SQL injection vulnerability in the elemid POST parameter of the viewcat.php endpoint that allows unauthenticated attackers to execute arbitrary SQL queries. [CVSS 7.5 HIGH]
Dolibarr ERP/CRM 10.0.1 contains multiple SQL injection vulnerabilities that allow authenticated attackers to manipulate database queries by injecting SQL code through POST parameters. [CVSS 7.5 HIGH]
Dolibarr ERP-CRM 14.0.2 contains a stored cross-site scripting vulnerability in the ticket creation module that allows low-privilege users to inject malicious scripts. [CVSS 5.4 MEDIUM]
Dolibarr ERP & CRM v21.0.1 were discovered to contain a remote code execution (RCE) vulnerability in the User module configuration via the computed field parameter.
A cross-site scripting (XSS) vulnerability in the Product module of Dolibarr v21.0.0-beta allows attackers to execute arbitrary web scripts or HTMl via a crafted payload injected into the Title. Rated critical severity (CVSS 9.0), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
A cross-site scripting (XSS) vulnerability in the Events/Agenda module of Dolibarr v21.0.0-beta allows attackers to execute arbitrary web scripts or HTMl via a crafted payload injected into the Title. Rated critical severity (CVSS 9.0), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
An arbitrary file upload vulnerability in the Upload Template function of Dolibarr ERP CRM up to v19.0.1 allows attackers to execute arbitrary code via uploading a crafted .SQL file. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. This Code Injection vulnerability could allow attackers to inject and execute arbitrary code within the application.
Vulnerabilities in Dolibarr ERP - CRM that affect version 9.0.1 and allow SQL injection. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Vulnerabilities in Dolibarr ERP - CRM that affect version 9.0.1 and allow SQL injection. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Incorrect access control in Dolibarr ERP CRM versions 19.0.0 and before, allows authenticated attackers to steal victim users' session cookies and CSRF protection tokens via user interaction with a. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable. No vendor patch available.
Lack of sanitization during Installation Process in Dolibarr ERP CRM up to version 19.0.0 allows an attacker with adjacent access to the network to execute arbitrary code via a specifically crafted. Rated high severity (CVSS 8.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Dolibarr is an enterprise resource planning (ERP) and customer relationship management (CRM) software package. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Improper Access Control in Dolibarr ERP CRM <= v17.0.3 allows an unauthorized authenticated user to read a database table containing customer data. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
Improper input validation in Dolibarr ERP CRM <= v18.0.1 fails to strip certain PHP code from user-supplied input when creating a Website, allowing an attacker to inject and evaluate arbitrary PHP. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity.
Cross-site Scripting (XSS) - Stored in GitHub repository dolibarr/dolibarr prior to 16.0.5. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
Cross-site Scripting (XSS) - Generic in GitHub repository dolibarr/dolibarr prior to 18.0. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Cross Site Scripting vulnerability in Dolibarr ERP CRM v.17.0.1 and before allows a remote attacker to obtain sensitive information and execute arbitrary code via the REST API module, related to. Rated critical severity (CVSS 9.6), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
File Upload vulnerability in Dolibarr ERP CRM v.17.0.1 and before allows a remote attacker to execute arbitrary code and obtain sensitive information via the extension filtering and renaming. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
An issue in Dolibarr ERP CRM v.17.0.1 and before allows a remote privileged attacker to execute arbitrary code via a crafted command/script. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 31.8%.
An issue in Dolibarr 16 before 16.0.5 allows unauthenticated attackers to perform a database dump and access a company's entire customer file, prospects, suppliers, and employee information if a. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
SQL injection attacks can result in unauthorized access to sensitive data, such as passwords, credit card details, or personal user information. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Dolibarr Open Source ERP & CRM for Business before v14.0.1 allows attackers to escalate privileges via a crafted API. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Dolibarr ERP & CRM <=15.0.3 is vulnerable to Eval injection. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Cross-site Scripting (XSS) - Stored in GitHub repository dolibarr/dolibarr prior to 16.0. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
Dolibarr 12.0.5 is vulnerable to Cross Site Scripting (XSS) via Sql Error Page. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Code Injection in GitHub repository dolibarr/dolibarr prior to 15.0.1. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
Business Logic Errors in GitHub repository dolibarr/dolibarr prior to 16.0. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
Improper Access Control (IDOR) in GitHub repository dolibarr/dolibarr prior to 16.0. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
admin/limits.php in Dolibarr 7.0.2 allows HTML injection, as demonstrated by the MAIN_MAX_DECIMALS_TOT parameter. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A Cross Site Scripting (XSS) vulnerability exists in Dolibarr before 14.0.3 via the ticket creation flow. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
The website builder module in Dolibarr 13.0.2 allows remote PHP code execution because of an incomplete protection mechanism in which system, exec, and shell_exec are blocked but backticks are not. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Dolibarr ERP and CRM 13.0.2 allows XSS via object details, as demonstrated by > and < characters in the onpointermove attribute of a BODY element to the user-management feature. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
In “Dolibarr” application, v2.8.1 to v13.0.2 are vulnerable to account takeover via password reset functionality. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity.
In “Dolibarr” application, v3.3.beta1_20121221 to v13.0.2 have “Modify” access for admin level users to change other user’s details but fails to validate already existing “Login” name, while renaming. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity.
In “Dolibarr ERP CRM”, WYSIWYG Editor module, v2.8.1 to v13.0.2 are affected by a stored XSS vulnerability that allows low privileged application users to store malicious scripts in the “Private. Rated critical severity (CVSS 9.0), this vulnerability is remotely exploitable, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
In “Dolibarr” application, 2.8.1 to 13.0.4 don’t restrict or incorrectly restricts access to a resource from an unauthorized actor. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity.
Dolibarr 12.0.3 is vulnerable to authenticated Remote Code Execution. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
Dolibarr before 11.0.5 allows low-privilege users to upload files of dangerous types, leading to arbitrary code execution. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Dolibarr 11.0.4 is affected by multiple stored Cross-Site Scripting (XSS) vulnerabilities that could allow remote authenticated attackers to inject arbitrary web script or HTML via. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Dolibarr CRM before 11.0.5 allows privilege escalation. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A reflected cross-site scripting (XSS) vulnerability in Dolibarr 11.0.3 allows remote attackers to inject arbitrary web script or HTML into public/notice.php (related to transphrase and transkey). Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
A SQL injection vulnerability in accountancy/customer/card.php in Dolibarr 11.0.3 allows remote authenticated users to execute arbitrary SQL commands via the id parameter. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity.
The DMS/ECM module in Dolibarr 11.0.4 allows users with the 'Setup documents directories' permission to rename uploaded files to have insecure file extensions. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
The DMS/ECM module in Dolibarr 11.0.4 renders user-uploaded .html files in the browser when the attachment parameter is removed from the direct download link. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Dolibarr before 11.0.4 allows XSS. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
core/get_menudiv.php in Dolibarr before 11.0.4 allows remote authenticated attackers to bypass intended access restrictions via a non-alphanumeric menu parameter. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity.
In Dolibarr 10.0.6, forms are protected with a CSRF token against CSRF attacks. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
In Dolibarr 10.0.6, if USER_LOGIN_FAILED is active, there is a stored XSS vulnerability on the admin tools --> audit page. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Dolibarr 11.0 allows XSS via the joinfiles, topic, or code parameter, or the HTTP Referer header. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
htdocs/user/passwordforgotten.php in Dolibarr 10.0.6 allows XSS via the Referer HTTP header. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
The htdocs/index.php?mainmenu=home login page in Dolibarr 10.0.6 allows an unlimited rate of failed authentication attempts. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Multiple cross-site scripting (XSS) vulnerabilities in Dolibarr 10.0.6 allow remote attackers to inject arbitrary web script or HTML via the (1) label[libelle] parameter to the. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Dolibarr CRM/ERP 10.0.3 allows viewimage.php?file= Stored XSS due to JavaScript execution in an SVG image for a profile picture. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
An issue was discovered in Dolibarr 10.0.2. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Authenticated Dolibarr administrators can run arbitrary operating-system commands as the web server user through the database export tool (htdocs/admin/tools/export.php) in every release before 24.0.0, because the restrict_os_commands allowlist can be bypassed by injecting a crafted mysqldump value. The attacker must already hold administrator rights (CVSS 4.0 base 8.6; assessed CVSS 3.1 AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) and exploitation is confined to the web server user's privileges, so there is no scope change to other systems; there is no CISA KEV entry and no public exploit identified at time of analysis, and the vendor rates the fix as this-week rather than emergency priority.
SQL injection in Dolibarr ERP CRM 19.0.0 through 23.0.3 (fixed in 23.0.4) allows an authenticated REST API user holding only the low-privilege societe/creer (third-party creation) permission to break out of the unescaped 'type' value when creating a company bank account. The injected payload reaches an unescaped string concatenation in CompanyBankAccount::create() and can be used in time-based blind subqueries to read password hashes and API keys from the database. Exploitation requires the REST API to be enabled and reachable plus valid credentials with that specific permission, so this is a conditional, credentialed attack rather than a drive-by one; no public exploit code has been identified at time of analysis and the vulnerability is not in CISA KEV.
Authenticated Dolibarr users with privileges to write extrafields, export configurations, or blocked log entries can trigger PHP object injection in versions before 23.0.4, potentially leading to code execution or file manipulation if a suitable gadget chain exists. The flaw resides in jsonOrUnserialize() and requires the stored payload to be non-JSON so that unserialize() runs without class restrictions; exploitation is high-complexity and no public exploit has been identified. Upgrading to 23.0.4 or later is the only complete fix.
Password hash extraction from any Dolibarr 24.0.0 user account, including administrators, is possible for authenticated low-privileged users via a case-sensitivity mismatch in the sqlfilters API parameter denylist. The PHP guard in dolForgeSQLCriteriaCallback() performs case-sensitive string matching against forbidden field names, while the underlying database resolves column names case-insensitively, allowing bypasses using uppercase variants such as PASSWORD instead of password. By submitting prefix-matching predicates as boolean oracle queries, an attacker can extract full credential hashes character-by-character without elevated privileges. No public exploit code has been identified at time of analysis; a patch commit is available upstream.
Path traversal via unsanitized MIME attachment filenames in Dolibarr's EmailCollector module allows any email sender to write attacker-controlled files outside the intended attachment directory, affecting versions 9.0.0 through 23.0.4. Because the EmailCollector is designed to ingest mail from unauthenticated external senders - such as a support or ticket inbox - no Dolibarr account is required to exploit this flaw. On hardened deployments with a read-only htdocs tree, the attacker can corrupt or forge documents belonging to other objects; on installations where htdocs is writable, the same write primitive reaches web-executable PHP paths, enabling remote code execution. No public exploit identified at time of analysis.
Incorrect authorization in Dolibarr's REST API before version 23.0.4 allows authenticated users holding only read-level module permissions to permanently delete documents via the DELETE /api/index.php/documents endpoint. The flaw in Documents::delete() at htdocs/api/class/api_documents.class.php passes the mode argument 'read' rather than 'write' to dol_check_secure_access_document(), meaning any API account with societe:lire, facture:lire, or equivalent read-only grants can irrecoverably destroy third-party files, invoices, orders, proposals, project files, and generated PDFs. No public exploit has been identified at time of analysis, but the corrective one-line commit diff is publicly visible on GitHub, making the flaw trivial to weaponize for any holder of low-privilege API credentials.
SQL injection in Dolibarr's CSV and XLSX import wizard (all versions before 24.0.0, including the most recent 23.0.4 stable release) allows an authenticated user holding the import permission to inject arbitrary SQL through the unsanitized updatekeys POST parameter. A crafted UNION SELECT payload simultaneously exfiltrates content from any database table the application account can read and hijacks the WHERE clause of the subsequent UPDATE to redirect which row is overwritten; for category link tables the raw filter array is spliced directly into UPDATE statements. No public exploit has been identified at time of analysis, and this CVE does not appear in the CISA KEV catalog.
Dolibarr's Members REST API before version 24.0.0 exposes bcrypt password hash verifiers to any authenticated user holding member-read rights, enabling offline password cracking attacks against member accounts. Both the member list and individual member detail endpoints return the crypted password verifier field because neither the base API serializer nor the Members API class applies field-level filtering to strip credential material from responses. A public proof-of-concept exists; this is not confirmed as actively exploited via CISA KEV, but the low access bar combined with exposed credential hashes and available exploit code makes this a genuine remediation priority for organizations running affected versions.
SQL injection in Dolibarr's users REST API (all versions before 24.0.0) allows authenticated users holding only user-read rights to exfiltrate sensitive database columns - including salary figures and password verifier hashes - that the API is explicitly designed to withhold from normal responses. The injection path targets unsanitized filter parameters concatenated directly into SQL WHERE clauses with no column-level access gating, enabling blind binary search on numeric fields and LIKE prefix iteration on string fields; raw database error messages in the same endpoint additionally leak internal column names. A publicly available exploit writeup documents the full technique (codeant.ai, VulnCheck); no CISA KEV listing is recorded at time of analysis.
Improper authorization in Dolibarr's expense report REST API update endpoint allows authenticated users with only expense-creation rights to self-approve their own expense reports by directly manipulating workflow state fields, including approval status and approver identity. All Dolibarr versions before 24.0.0 are affected; a publicly available proof-of-concept exploit demonstrates the bypass. While not listed in CISA KEV, the publicly available exploit and the financial integrity impact - including forged audit records and missing approval timestamps - make this a meaningful risk for organizations running Dolibarr for financial operations.
Dolibarr's REST API user-update endpoint permits any low-privileged account holding user-write rights to overwrite payroll fields - salary, bonus, hourly rate, daily rate, and weekly hours - for arbitrary user records, bypassing intended payroll-role access controls. All Dolibarr versions before 24.0.0 are affected due to an incomplete field denylist that fails to exclude payroll columns from mass-assignment in the API layer. A publicly available proof-of-concept exploit exists; no confirmed active exploitation has been recorded in CISA KEV at the time of analysis, but vendor-released patch version 24.0.0 is available.
Broken object-level authorization (BOLA) in Dolibarr's REST API bank account write routes permits any authenticated user holding third-party creation rights to overwrite bank account details - including IBANs - for any company in the system, regardless of whether they have read access to that company. When SEPA credit-transfer files are subsequently regenerated from the tampered records, outgoing supplier payments are silently redirected to attacker-controlled accounts, enabling financial fraud at scale. Publicly available exploit code exists per VulnCheck and codeant.ai research; the vulnerability is not yet listed in CISA KEV but the financial impact potential elevates real-world priority above the 7.1 CVSS score alone suggests.
Incorrect authorization in Dolibarr's payments REST API delete endpoint exposes all payment records to deletion by any authenticated user holding invoice-deletion rights, regardless of whether they possess payment-issuance rights. All Dolibarr installations prior to version 24.0.0 are affected. Exploitation results in permanent removal of payment records, zeroing of paid invoice amounts, and corruption of accounting exports - a high-integrity, high-availability financial data loss. Publicly available exploit code exists, lowering the attack barrier; active exploitation has not been confirmed by CISA KEV at time of analysis.
Broken object-level authorization (BOLA) in Dolibarr's REST API write routes for third-party site accounts allows any authenticated user holding third-party creation rights to overwrite the WebPortal password of any company in the system, regardless of ownership. After replacing the password, the attacker can log into the victim company's WebPortal and access its invoice data; the write endpoint also returns the victim's previous password verifier, enabling potential offline credential attacks. A public proof-of-concept is available; no confirmed active exploitation (CISA KEV) at time of analysis, but the low attack complexity and available PoC make this a genuine priority for all pre-24.0.0 deployments.
Improper authorization in Dolibarr's Members REST API (all versions before 24.0.0) allows any authenticated user holding member-creation rights to overwrite the password of any system account - including the administrator - without possessing password-change permissions. The attacker supplies an arbitrary user identifier and replacement password in the API request body, immediately gaining control of the target account and locking out its legitimate holder. A publicly available proof-of-concept exists; no active exploitation has been confirmed in CISA KEV at the time of analysis.
SQL injection in Dolibarr ERP/CRM through version 23.0.3 lets authenticated REST API users exfiltrate arbitrary database contents - including password hashes and API keys - by abusing the sqlfilters parameter on the setup dictionary and multicurrencies list endpoints. The flawed filter only checked for balanced parentheses and rewrote matched triplets, so an appended UNION SELECT placed outside the expected pattern was concatenated into the WHERE clause unmodified. Publicly available exploit code exists and a vendor fix has been committed; the issue is not listed in CISA KEV.
Command injection in Dolibarr ERP/CRM versions before 23.0.0 allows authenticated administrators to execute arbitrary operating system commands during ODT-to-PDF template conversion. The vulnerability stems from unsanitized concatenation of the MAIN_ODT_AS_PDF configuration constant into shell commands in odf.php. Exploitation requires administrative privileges (PR:H) but can be executed remotely (AV:N) with low complexity (AC:L), resulting in full system compromise as the web server user. Fixed in version 23.0.0. EPSS data not available; no public exploit identified at time of analysis.
Remote code execution in Dolibarr ERP/CRM versions prior to 23.0.2 allows authenticated administrators to execute arbitrary system commands by exploiting inadequate input validation in the dol_eval_standard() function. The vulnerability enables attackers to bypass security controls using PHP dynamic callable syntax through computed extrafields or other evaluation paths. With a CVSS score of 7.2 and publicly available exploit code documented by Jiva Security, this represents an elevated risk for organizations running unpatched Dolibarr instances, though exploitation requires high-privilege administrator access (CVSS:3.1/PR:H), limiting the attack surface to insider threats or compromised admin accounts.
Dolibarr before 17.0.1 allows remote code execution by an authenticated user via an uppercase manipulation: <?PHP instead of <?php in injected data. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Unauthenticated information disclosure in Dolibarr ERP/CRM before 24.0.2 lets remote users read unpublished draft job positions through the public recruitment script htdocs/public/recruitment/view.php. Exposure is confined to deployments that have enabled the optional RECRUITMENT_ENABLE_PUBLIC_INTERFACE setting; there, walking sequential provisional 'ref' values reveals job titles, descriptions, salary budgets and recruiter names and emails, with confidentiality-only impact and no effect on integrity or availability. No public exploit has been identified at time of analysis, and the vendor patch is available in 24.0.2 (fixes in pull request 41108).
Dolibarr up to and including 23.0.2 uses a weakened Content-Security-Policy on its document-serving endpoints: htdocs/document.php and htdocs/viewimage.php define MAIN_SECURITY_FORCECSP with form-action 'self' instead of the stricter form-action 'none'. This is a defense-in-depth protection-mechanism failure, not a directly exploitable injection flaw; meaningful abuse generally requires a separate content-injection primitive to place a malicious form into content served from those endpoints, which constrains real-world exploitability. The CVSS vector requires authenticated access (PR:L) and no user interaction, and the issue is assessed as moderate-to-low priority; no public exploit was identified at time of analysis, and upgrading to 24.0.0 resolves it.
Authenticated Dolibarr ERP CRM users who hold only read permission on a record can persistently modify that record's extrafield values in all versions before 24.0.2, because the AJAX endpoint htdocs/core/ajax/updateextrafield.php calls restrictedArea() without the 'write' mode flag and therefore enforces only read access. Exploitation requires a valid authenticated session plus read visibility of the target object (third party, product, member, project or contact) and a crafted POST supplying objectType, objectId, field and value; no victim interaction is needed, but the flaw is confined to integrity of extrafield data (CVSS 4.0 5.3, PR:L, I:L) with no confidentiality or availability impact. No public exploit code has been identified at time of analysis and the issue is not in CISA KEV, so this is a moderate-risk authorization weakness rather than an emergency; vendor patch data confirms a fix is available in 24.0.2.
Improper access control in Dolibarr's Legacy File Manager connector allows any authenticated user - regardless of assigned module permissions - to access and interact with the medias directory. Affected versions span up to 21.0.4, 22.0.5, and 23.0.3. A public exploit exists via GitHub issue #38963, and the patch commit (ef6631e9bd5ec4b8cec0e88f1796d3d10dad02ec) confirms that the vulnerable file (htdocs/core/filemanagerdol/connectors/php/config.inc.php) entirely lacked an authorization gate, meaning even zero-privilege authenticated accounts could reach the file manager. No active exploitation (CISA KEV) has been confirmed.
Insecure Direct Object Reference in Dolibarr's Users::getGroups REST API endpoint allows any authenticated user to read group memberships of arbitrary users across tenant boundaries without authorization. Versions 10.0.0 through 23.x omit the per-object access check in GET /users/{id}/groups, exposing group names, entity associations, and private notes to any API credential holder. Fixed in 24.0.0; no public exploit or CISA KEV listing identified at time of analysis.
Authorization bypass in Dolibarr ERP versions 21.0.0 through 23.x allows authenticated users holding project-creation permission to clone tasks into private projects they are not authorized to access. The flaw is an inverted boolean logic error in the clonetasks mass action handler - `!in_array()` is used where `in_array()` is required, causing the private-project membership check to pass precisely for unauthorized users and fail for authorized ones. No public exploit code exists and this vulnerability is not listed in CISA KEV; however, the low attack complexity (AC:L) means any authenticated user with project-creation rights can trivially abuse the flaw against any private project in the same Dolibarr instance.
Reflected XSS in Dolibarr's extra fields administration template (all versions before 24.0.0) allows an unauthenticated attacker to execute arbitrary JavaScript in an authenticated administrator's browser session by delivering a crafted URL containing a malicious `type` parameter. The parameter is echoed without JavaScript-context encoding directly into an inline script block, and no Content-Security-Policy header is present to block the execution. Successful exploitation enables the attacker to create a persistent backdoor administrator account, constituting a full application takeover with no KEV listing but publicly available exploit code confirmed by VulnCheck.
Authorization bypass in Dolibarr ERP up to versions 18.0.10, 22.0.5, and 23.0.3 allows any low-privileged authenticated user to read or overwrite another user's private notes by manipulating the numeric `id` parameter in `/user/note.php`. The root cause (CWE-639 - Authorization Bypass Through User-Controlled Key) is a missing identity check before the permission evaluation: all requests were evaluated under the caller's self-write right rather than distinguishing whether the target user matched the caller. A proof-of-concept exists (CVSS 4.0 E:P), though no active exploitation has been confirmed via CISA KEV. Patches are available in versions 23.0.4 and 24.0.0.
LDAP injection in Dolibarr's User Cloning component (htdocs/user/card.php) through version 23.0.3 allows authenticated remote attackers to manipulate LDAP query logic by crafting the user ID argument. Any valid Dolibarr user with access to the User Cloning feature can exploit this without additional privileges or user interaction. A public exploit has been released on Google Drive, substantially lowering the barrier for abuse; no active exploitation is confirmed in CISA KEV at time of analysis.
Missing authorization in Dolibarr ERP's TakePOS module through version 23.0.3 permits authenticated users with only basic cashier-level access to perform sensitive invoice operations - deleting line items, adjusting quantities, modifying prices, and applying discounts - that require the elevated `editlines` permission. The flaw exists because htdocs/takepos/invoice.php processes these actions without verifying the caller holds the `takepos.editlines` right, creating a privilege boundary bypass within the POS subsystem. An upstream patch commit (8992ce8704da947b6abe7b65a6fe59aed736bb81) is available; no CISA KEV listing and no public exploit code identified at time of analysis.
Horizontal privilege escalation in Dolibarr ERP CRM through version 23.0.1 permits any authenticated low-privilege user to read other users' leave request records via the Leave Request REST API, with a publicly available proof-of-concept confirming exploitability. The flaw in `checkUserAccessToObject` within `api_holidays.class.php` (CWE-285, Improper Authorization) arises because the access control helper receives only an integer object ID rather than the full object, causing ownership validation to fail silently and return another user's confidential HR data. No active exploitation is confirmed in CISA KEV, but the public POC and low attack complexity make this a realistic insider or multi-tenant threat requiring prompt patching.
Insecure Direct Object Reference in Dolibarr ERP CRM 23.0.0-23.0.2 allows any authenticated low-privilege user to read another user's messaging records by manipulating the `id` parameter in `htdocs/user/messaging.php`. The commit diff confirms the endpoint performed zero ownership or permission validation before serving messaging data - any valid session could enumerate other users' messages by cycling numeric IDs. No public exploit code has been identified and this CVE does not appear in CISA KEV, but the vulnerability is trivially exploitable given its low complexity and minimal authentication barrier.
Dolibarr ERP CRM 7.0.3 contains a remote code evaluation vulnerability that allows unauthenticated attackers to execute arbitrary code by injecting PHP code through the db_name parameter. Rated critical severity (CVSS 9.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Remote code execution in Dolibarr ERP/CRM versions ≤22.0.2 allows authenticated administrators to execute arbitrary PHP code by injecting malicious payloads into the 'computed value' field of user extrafields, which are passed unsanitized to PHP's eval() function. No vendor patch exists at time of analysis (zero-day status), but exploitation requires high-privilege administrator access, limiting immediate risk to environments with compromised admin accounts or malicious insiders. EPSS data unavailable; not listed in CISA KEV, indicating no confirmed widespread exploitation despite public technical disclosure.
Improper cryptographic signature verification in Dolibarr ERP CRM up to version 23.0.2 allows remote attackers to bypass signature validation in the Online Signature Module, potentially forging or manipulating signed transactions. The vulnerability affects the dol_verifyHash function and has been publicly disclosed with exploit code available, though exploitation requires high technical complexity and is not confirmed as actively exploited in production environments.
SQL injection in Dolibarr ERP CRM up to version 23.0.2 allows authenticated remote attackers to execute arbitrary SQL queries via the fields parameter in the Shipments API Endpoint (_checkValForAPI function). Exploitation requires high attack complexity and authenticated access, with publicly available exploit code confirmed but no active exploitation reported in CISA KEV at time of analysis.
Dolibarr ERP-CRM 8.0.4 contains an SQL injection vulnerability in the rowid parameter of the admin dict.php endpoint that allows attackers to execute arbitrary SQL queries. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Dolibarr ERP/CRM 10.0.1 contains an SQL injection vulnerability in the elemid POST parameter of the viewcat.php endpoint that allows unauthenticated attackers to execute arbitrary SQL queries. [CVSS 7.5 HIGH]
Dolibarr ERP/CRM 10.0.1 contains multiple SQL injection vulnerabilities that allow authenticated attackers to manipulate database queries by injecting SQL code through POST parameters. [CVSS 7.5 HIGH]
Dolibarr ERP-CRM 14.0.2 contains a stored cross-site scripting vulnerability in the ticket creation module that allows low-privilege users to inject malicious scripts. [CVSS 5.4 MEDIUM]
Dolibarr ERP & CRM v21.0.1 were discovered to contain a remote code execution (RCE) vulnerability in the User module configuration via the computed field parameter.
A cross-site scripting (XSS) vulnerability in the Product module of Dolibarr v21.0.0-beta allows attackers to execute arbitrary web scripts or HTMl via a crafted payload injected into the Title. Rated critical severity (CVSS 9.0), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
A cross-site scripting (XSS) vulnerability in the Events/Agenda module of Dolibarr v21.0.0-beta allows attackers to execute arbitrary web scripts or HTMl via a crafted payload injected into the Title. Rated critical severity (CVSS 9.0), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
An arbitrary file upload vulnerability in the Upload Template function of Dolibarr ERP CRM up to v19.0.1 allows attackers to execute arbitrary code via uploading a crafted .SQL file. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. This Code Injection vulnerability could allow attackers to inject and execute arbitrary code within the application.
Vulnerabilities in Dolibarr ERP - CRM that affect version 9.0.1 and allow SQL injection. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Vulnerabilities in Dolibarr ERP - CRM that affect version 9.0.1 and allow SQL injection. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Incorrect access control in Dolibarr ERP CRM versions 19.0.0 and before, allows authenticated attackers to steal victim users' session cookies and CSRF protection tokens via user interaction with a. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable. No vendor patch available.
Lack of sanitization during Installation Process in Dolibarr ERP CRM up to version 19.0.0 allows an attacker with adjacent access to the network to execute arbitrary code via a specifically crafted. Rated high severity (CVSS 8.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Dolibarr is an enterprise resource planning (ERP) and customer relationship management (CRM) software package. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Improper Access Control in Dolibarr ERP CRM <= v17.0.3 allows an unauthorized authenticated user to read a database table containing customer data. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
Improper input validation in Dolibarr ERP CRM <= v18.0.1 fails to strip certain PHP code from user-supplied input when creating a Website, allowing an attacker to inject and evaluate arbitrary PHP. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity.
Cross-site Scripting (XSS) - Stored in GitHub repository dolibarr/dolibarr prior to 16.0.5. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
Cross-site Scripting (XSS) - Generic in GitHub repository dolibarr/dolibarr prior to 18.0. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Cross Site Scripting vulnerability in Dolibarr ERP CRM v.17.0.1 and before allows a remote attacker to obtain sensitive information and execute arbitrary code via the REST API module, related to. Rated critical severity (CVSS 9.6), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
File Upload vulnerability in Dolibarr ERP CRM v.17.0.1 and before allows a remote attacker to execute arbitrary code and obtain sensitive information via the extension filtering and renaming. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
An issue in Dolibarr ERP CRM v.17.0.1 and before allows a remote privileged attacker to execute arbitrary code via a crafted command/script. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 31.8%.
An issue in Dolibarr 16 before 16.0.5 allows unauthenticated attackers to perform a database dump and access a company's entire customer file, prospects, suppliers, and employee information if a. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
SQL injection attacks can result in unauthorized access to sensitive data, such as passwords, credit card details, or personal user information. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Dolibarr Open Source ERP & CRM for Business before v14.0.1 allows attackers to escalate privileges via a crafted API. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Dolibarr ERP & CRM <=15.0.3 is vulnerable to Eval injection. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Cross-site Scripting (XSS) - Stored in GitHub repository dolibarr/dolibarr prior to 16.0. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
Dolibarr 12.0.5 is vulnerable to Cross Site Scripting (XSS) via Sql Error Page. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Code Injection in GitHub repository dolibarr/dolibarr prior to 15.0.1. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
Business Logic Errors in GitHub repository dolibarr/dolibarr prior to 16.0. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
Improper Access Control (IDOR) in GitHub repository dolibarr/dolibarr prior to 16.0. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
admin/limits.php in Dolibarr 7.0.2 allows HTML injection, as demonstrated by the MAIN_MAX_DECIMALS_TOT parameter. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A Cross Site Scripting (XSS) vulnerability exists in Dolibarr before 14.0.3 via the ticket creation flow. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
The website builder module in Dolibarr 13.0.2 allows remote PHP code execution because of an incomplete protection mechanism in which system, exec, and shell_exec are blocked but backticks are not. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Dolibarr ERP and CRM 13.0.2 allows XSS via object details, as demonstrated by > and < characters in the onpointermove attribute of a BODY element to the user-management feature. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
In “Dolibarr” application, v2.8.1 to v13.0.2 are vulnerable to account takeover via password reset functionality. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity.
In “Dolibarr” application, v3.3.beta1_20121221 to v13.0.2 have “Modify” access for admin level users to change other user’s details but fails to validate already existing “Login” name, while renaming. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity.
In “Dolibarr ERP CRM”, WYSIWYG Editor module, v2.8.1 to v13.0.2 are affected by a stored XSS vulnerability that allows low privileged application users to store malicious scripts in the “Private. Rated critical severity (CVSS 9.0), this vulnerability is remotely exploitable, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
In “Dolibarr” application, 2.8.1 to 13.0.4 don’t restrict or incorrectly restricts access to a resource from an unauthorized actor. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity.
Dolibarr 12.0.3 is vulnerable to authenticated Remote Code Execution. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
Dolibarr before 11.0.5 allows low-privilege users to upload files of dangerous types, leading to arbitrary code execution. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Dolibarr 11.0.4 is affected by multiple stored Cross-Site Scripting (XSS) vulnerabilities that could allow remote authenticated attackers to inject arbitrary web script or HTML via. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Dolibarr CRM before 11.0.5 allows privilege escalation. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A reflected cross-site scripting (XSS) vulnerability in Dolibarr 11.0.3 allows remote attackers to inject arbitrary web script or HTML into public/notice.php (related to transphrase and transkey). Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
A SQL injection vulnerability in accountancy/customer/card.php in Dolibarr 11.0.3 allows remote authenticated users to execute arbitrary SQL commands via the id parameter. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity.
The DMS/ECM module in Dolibarr 11.0.4 allows users with the 'Setup documents directories' permission to rename uploaded files to have insecure file extensions. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
The DMS/ECM module in Dolibarr 11.0.4 renders user-uploaded .html files in the browser when the attachment parameter is removed from the direct download link. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Dolibarr before 11.0.4 allows XSS. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
core/get_menudiv.php in Dolibarr before 11.0.4 allows remote authenticated attackers to bypass intended access restrictions via a non-alphanumeric menu parameter. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity.
In Dolibarr 10.0.6, forms are protected with a CSRF token against CSRF attacks. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
In Dolibarr 10.0.6, if USER_LOGIN_FAILED is active, there is a stored XSS vulnerability on the admin tools --> audit page. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Dolibarr 11.0 allows XSS via the joinfiles, topic, or code parameter, or the HTTP Referer header. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
htdocs/user/passwordforgotten.php in Dolibarr 10.0.6 allows XSS via the Referer HTTP header. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
The htdocs/index.php?mainmenu=home login page in Dolibarr 10.0.6 allows an unlimited rate of failed authentication attempts. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Multiple cross-site scripting (XSS) vulnerabilities in Dolibarr 10.0.6 allow remote attackers to inject arbitrary web script or HTML via the (1) label[libelle] parameter to the. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Dolibarr CRM/ERP 10.0.3 allows viewimage.php?file= Stored XSS due to JavaScript execution in an SVG image for a profile picture. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
An issue was discovered in Dolibarr 10.0.2. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.