Affected version lines
Known vulnerabilities
| CVE | Title | Affected versions | CVSS | Exploited | EPSS | Published |
|---|---|---|---|---|---|---|
| CVE-2026-89037 | Dolibarr < 24.0.2 IDOR via Ticket Documents API | < 24.0.2 | 7.1 | 0.4% | 2026-11-14 | |
| CVE-2026-125754 | Dolibarr 20.0.0 through 23.0.4 and 24.x before 24.0.2 IDOR via ExpenseReport Payment API | ≥ 20.0.0 ≤ 23.0.4 ≥ 24.0.0 < 24.0.2 | 7.1 | 0.2% | 2026-11-11 | |
| CVE-2026-33944 | Dolibarr: SQL Injection in societe/class/societe.class.php via localtax1_value parameter | * | 8.8 | — | 2026-11-06 | |
| CVE-2026-118754 | Dolibarr ERP CRM before 24.0.2 Missing Authorization via public recruitment view.php | * | 6.9 | — | 2026-10-29 | |
| CVE-2026-116219 | Dolibarr ERP CRM before 24.0.0 OS Command Injection via mysqldump Parameter | < 24.0.0 | 8.6 | 2.1% | 2026-10-26 | |
| CVE-2026-116218 | Dolibarr ERP CRM 19.0.0 before 23.0.4 SQL Injection via bankaccounts API type field | ≥ 19.0.0 < 23.0.4 | 7.2 | 0.3% | 2026-10-26 | |
| CVE-2026-110874 | Dolibarr before 23.0.4 PHP Object Injection via jsonOrUnserialize() | < 23.0.4 | 7.5 | — | 2026-10-16 | |
| CVE-2026-107706 | Dolibarr before 24.0.2 Incorrect Authorization via updateextrafield.php | < 24.0.2 | 5.3 | — | 2026-10-09 | |
| CVE-2026-89013 | Dolibarr 23.0.4 < 24.0.1 Authorization Bypass via hashp Parameter in document.php | ≥ 23.0.4 < 24.0.1 | 8.7 | — | 2026-09-12 | |
| CVE-2026-89012 | Dolibarr 24.0.0 < 24.0.1 SQL Filter Denylist Bypass via sqlfilters Parameter | ≥ 24.0.0 < 24.0.1 | 7.1 | — | 2026-09-12 | |
| CVE-2026-82633 | Dolibarr 10.0.0 before 24.0.0 Missing Authorization on REST Users Groups Endpoint | ≥ 10.0.0 < 24.0.0 | 5.3 | — | 2026-08-30 | |
| CVE-2026-81730 | Dolibarr 9.0.0 through 23.0.4 Path Traversal via EmailCollector Attachment Filename | ≥ 9.0.0 < 24.0.0 | 8.8 | — | 2026-08-28 | |
| CVE-2026-81729 | Dolibarr before 23.0.4 Incorrect Authorization on REST API Document Deletion | < 23.0.4 | 7.1 | — | 2026-08-28 | |
| CVE-2026-81728 | Dolibarr before 24.0.0 SQL Injection via the CSV and XLSX Import Update Keys | < 24.0.0 | 8.6 | — | 2026-08-28 | |
| CVE-2026-77923 | Dolibarr 21.0.0 < 24.0.0 Authorization Bypass via clonetasks Mass Action | ≥ 21.0.0 < 24.0.0 | 5.3 | — | 2026-08-25 | |
| CVE-2026-71511 | Dolibarr < 24.0.0 Members REST API Sensitive Data Exposure via Member Endpoints | < 24.0.0 | 7.1 | — | 2026-08-25 | |
| CVE-2026-71510 | Dolibarr < 24.0.0 Users REST API SQL Injection via filter parameter | < 24.0.0 | 7.1 | — | 2026-08-25 | |
| CVE-2026-71509 | Dolibarr < 24.0.0 Expense Report REST API Improper Authorization via Update Endpoint | < 24.0.0 | 7.1 | — | 2026-08-25 | |
| CVE-2026-71508 | Dolibarr < 24.0.0 REST API Improper Authorization via User Update Endpoint | < 24.0.0 | 7.1 | — | 2026-08-25 | |
| CVE-2026-71507 | Dolibarr < 24.0.0 REST API Broken Object-Level Authorization via Bank Account Routes | < 24.0.0 | 7.1 | — | 2026-08-25 | |
| CVE-2026-71506 | Dolibarr < 24.0.0 Payments REST API Improper Authorization via Delete Endpoint | < 24.0.0 | 7.2 | — | 2026-08-25 | |
| CVE-2026-71505 | Dolibarr < 24.0.0 REST API Broken Object-Level Authorization via Third-Party Write Route | < 24.0.0 | 7.1 | — | 2026-08-25 | |
| CVE-2026-71504 | Dolibarr < 24.0.0 Members REST API Improper Authorization via Password Reset | < 24.0.0 | 8.6 | — | 2026-08-25 | |
| CVE-2026-71503 | Dolibarr < 24.0.0 Reflected XSS via Extra Fields Administration Template | < 24.0.0 | 5.1 | — | 2026-08-25 | |
| CVE-2026-78160 | Dolibarr ERP User Notes note.php authorization | * | 5.3 | — | 2026-08-24 | |
| CVE-2026-19350 | Dolibarr ERP TakePOS invoice.php fail authorization | * | 5.3 | — | 2026-08-09 | |
| CVE-2026-58376 | Dolibarr - SQL Injection via sqlfilters Parameter in Multiple REST API List Endpoints | ≤ 23.0.3 | 7.2 | — | 2026-07-01 | |
| CVE-2026-11619 | Dolibarr ERP CRM Legacy Filemanager config.inc.php improper authorization | * | 5.3 | — | 2026-06-09 | |
| CVE-2026-10215 | Dolibarr ERP CRM Leave Request REST API api_holidays.class.php checkUserAccessToObject improper authorization | * | 5.3 | — | 2026-06-01 | |
| CVE-2026-10154 | Dolibarr ERP CRM messaging.php authorization | * | 5.3 | — | 2026-05-31 | |
| CVE-2026-37713 | An issue in Dolibarr ERP/CRM v.22.0.0 through v.22.0.4 and v.24.0.0-alpha allows a remote attacker to execute... | * | 7.3 | — | 2026-05-27 | |
| CVE-2026-37712 | An issue in Dolibarr ERP/CRM v.22.0.0 through v.22.0.4 and v.24.0.0-alpha allows a remote attacker to execute... | * | 7.3 | — | 2026-05-27 | |
| CVE-2026-37711 | An issue in Dolibarr ERP/CRM v.22.0.0 through v.22.0.4 and v.24.0.0-alpha allows a remote attacker to execute... | * | 7.3 | — | 2026-05-27 | |
| CVE-2018-25357 | Dolibarr ERP CRM 7.0.3 Remote Code Execution via install/step1.php | * | 9.3 | — | 2026-05-24 | |
| CVE-2025-67486 | Dolibarr has an Authenticated Remote Code Execution via eval() injection in user extrafields | * | 8.6 | — | 2026-05-08 | |
| CVE-2026-23500 | Dolibarr: OS Command Injection (RCE) via MAIN_ODT_AS_PDF configuration | * | 9.4 | — | 2026-04-18 | |
| CVE-2026-22666 | Dolibarr ERP/CRM < 23.0.2 Authenticated RCE via dol_eval_standard() | < 23.0.2 | 8.6 | — | 2026-04-07 | |
| CVE-2026-34036 | Dolibarr Core Discloses Sensitive Data via Authenticated Local File Inclusion in selectobject.php | * | 6.5 | — | 2026-03-31 | |
| CVE-2020-36966 | Dolibarr 11.0.3 - 'ldap.php' - Persistent Cross-Site Scripting | ≤ 11.0.3 | 5.1 | — | 2026-01-31 | |
| CVE-2024-55228 | A cross-site scripting (XSS) vulnerability in the Product module of Dolibarr v21.0.0-beta allows attackers to... | * | 9.0 | — | 2025-01-27 | |
| CVE-2024-55227 | A cross-site scripting (XSS) vulnerability in the Events/Agenda module of Dolibarr v21.0.0-beta allows attacke... | * | 9.0 | — | 2025-01-27 | |
| CVE-2021-3991 | Improper Authorization in dolibarr/dolibarr | * | 4.3 | — | 2024-11-15 | |
| CVE-2024-23817 | Dolibarr Application Home Page HTML injection vulnerability | * | 7.1 | — | 2024-01-26 | |
| CVE-2023-4198 | Dolibarr ERP CRM (<= 17.0.3) Improper Access Control | ≤ 17.0.3 | 6.5 | — | 2023-11-01 | |
| CVE-2023-4197 | Dolibarr ERP CRM (<= 18.0.1) Improper Input Sanitization Authenticated RCE | ≤ 18.0.1 | 7.5 | — | 2023-11-01 | |
| CVE-2023-5842 | Cross-site Scripting (XSS) - Stored in dolibarr/dolibarr | * | 4.8 | — | 2023-10-30 | |
| CVE-2023-5323 | Cross-site Scripting (XSS) - Generic in dolibarr/dolibarr | * | 5.4 | — | 2023-10-01 | |
| CVE-2023-33568 | An issue in Dolibarr 16 before 16.0.5 allows unauthenticated attackers to perform a database dump and access a... | * | — | — | 2023-06-13 | |
| CVE-2023-30253 | Dolibarr before 17.0.1 allows remote code execution by an authenticated user via an uppercase manipulation: <?... | * | 8.8 | — | 2023-05-29 | |
| CVE-2022-4093 | SQL Injection in dolibarr/dolibarr | * | 8.1 | — | 2022-11-21 | |
| CVE-2022-2060 | Cross-site Scripting (XSS) - Stored in dolibarr/dolibarr | * | 8.4 | — | 2022-06-13 | |
| CVE-2021-37517 | An Access Control vulnerability exists in Dolibarr ERP/CRM 13.0.2, fixed version is 14.0.0,in the forgot-passw... | * | — | — | 2022-04-01 | |
| CVE-2021-36625 | An SQL Injection vulnerability exists in Dolibarr ERP/CRM 13.0.2 (fixed version is 14.0.0) via a POST request... | * | — | — | 2022-04-01 | |
| CVE-2022-0819 | Code Injection in dolibarr/dolibarr | * | 7.2 | — | 2022-03-03 | |
| CVE-2022-0746 | Business Logic Errors in dolibarr/dolibarr | * | 4.3 | — | 2022-02-25 | |
| CVE-2022-0731 | Improper Access Control (IDOR) in dolibarr/dolibarr | * | 5.4 | — | 2022-02-24 | |
| CVE-2022-0414 | Improper Validation of Specified Quantity in Input in dolibarr/dolibarr | * | 4.1 | — | 2022-01-31 | |
| CVE-2022-0224 | SQL Injection in dolibarr/dolibarr | * | 8.3 | — | 2022-01-15 | |
| CVE-2022-0174 | Improper Validation of Specified Quantity in Input in dolibarr/dolibarr | * | 4.3 | — | 2022-01-11 | |
| CVE-2022-22293 | admin/limits.php in Dolibarr 7.0.2 allows HTML injection, as demonstrated by the MAIN_MAX_DECIMALS_TOT paramet... | * | — | — | 2022-01-02 |
Track these versions on your own servers
InfraGuard collects installed software versions from every server and flags the ones with known vulnerabilities. Self-hosted — nothing leaves your network.
Data: CVE List (CVE® Program), NVD, CISA KEV, FIRST EPSS (see EPSS at https://www.first.org/epss), endoflife.date. Software list: awesome-selfhosted (CC BY-SA 3.0).