Advisories · Technology

Dolibarr ERP/CRM.

Every CVE that names Dolibarr ERP/CRM among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.

CVE-2026-118754 CVE record

CVSS 6.9 Medium

Dolibarr ERP CRM before 24.0.2 Missing Authorization via public recruitment view.php
- Dolibarr ERP/CRM
- Broken access control
Not analysed yet 28 Oct 2026
CVE-2026-11619 CVE record

CVSS 5.3 Medium

Dolibarr ERP CRM Legacy Filemanager config.inc.php improper authorization
- Dolibarr ERP CRM
- Privilege escalation
- Broken access control
Not analysed yet 9 Jun 2026
CVE-2026-10154 CVE record

CVSS 5.3 Medium

Dolibarr ERP CRM messaging.php authorization
- Dolibarr ERP CRM
- Broken access control
Not analysed yet 30 May 2026
CVE-2026-22666 CVE record

CVSS 8.6 HighCritical · CVSS 7+ and EPSS

Dolibarr ERP/CRM < 23.0.2 Authenticated RCE via dol_eval_standard()
- Dolibarr ERP/CRM
- Code injection
Not analysed yet 7 Apr 2026
CVE-2019-25452 CVE record

CVSS 8.8 High

Dolibarr ERP/CRM 10.0.1 SQL Injection via elemid
- Dolibarr ERP/CRM
- SQL injection
Not analysed yet 22 Feb 2026
CVE-2019-25450 CVE record

CVSS 7.1 High

Dolibarr ERP/CRM 10.0.1 SQL Injection via card.php
- Dolibarr ERP/CRM
- SQL injection
Not analysed yet 22 Feb 2026