Advisories · Technology
dolibarr.
Every CVE that names dolibarr among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 8.6 High
Dolibarr ERP CRM before 24.0.0 OS Command Injection via mysqldump Parameter
- dolibarr
- Command injection
- CVSS 7.2 High
Dolibarr ERP CRM 19.0.0 before 23.0.4 SQL Injection via bankaccounts API type field
- dolibarr
- SQL injection
- CVSS 5.3 Medium
Dolibarr CSP document.php protection mechanism
- Dolibarr
- CWE-693
- CVSS 7.5 High
Dolibarr before 23.0.4 PHP Object Injection via jsonOrUnserialize()
- dolibarr
- Insecure deserialization
- CVSS 5.3 Medium
Dolibarr before 24.0.2 Incorrect Authorization via updateextrafield.php
- dolibarr
- Broken access control
- CVSS 8.7 High
Dolibarr 23.0.4 < 24.0.1 Authorization Bypass via hashp Parameter in document.php
- Dolibarr
- Broken access control
- CVSS 7.1 High
Dolibarr 24.0.0 < 24.0.1 SQL Filter Denylist Bypass via sqlfilters Parameter
- Dolibarr
- CWE-178
- CVSS 5.3 Medium
Dolibarr Legacy File Manager config.inc.php access control
- Dolibarr
- Privilege escalation
- Broken access control
- CVSS 5.3 Medium
Dolibarr 10.0.0 before 24.0.0 Missing Authorization on REST Users Groups Endpoint
- dolibarr
- Broken access control
- CVSS 8.8 High
Dolibarr 9.0.0 through 23.0.4 Path Traversal via EmailCollector Attachment Filename
- dolibarr
- Path traversal
- CVSS 7.1 High
Dolibarr before 23.0.4 Incorrect Authorization on REST API Document Deletion
- dolibarr
- Broken access control
- CVSS 8.6 High
Dolibarr before 24.0.0 SQL Injection via the CSV and XLSX Import Update Keys
- dolibarr
- SQL injection
- CVSS 5.3 Medium
Dolibarr 21.0.0 < 24.0.0 Authorization Bypass via clonetasks Mass Action
- dolibarr
- Broken access control
- CVSS 7.1 High
Dolibarr < 24.0.0 Members REST API Sensitive Data Exposure via Member Endpoints
- dolibarr
- Hard-coded credentials
- CVSS 7.1 High
Dolibarr < 24.0.0 Users REST API SQL Injection via filter parameter
- dolibarr
- Broken access control
- CVSS 7.1 High
Dolibarr < 24.0.0 Expense Report REST API Improper Authorization via Update Endpoint
- dolibarr
- Broken access control
- CVSS 7.1 High
Dolibarr < 24.0.0 REST API Improper Authorization via User Update Endpoint
- dolibarr
- Broken access control
- CVSS 7.1 High
Dolibarr < 24.0.0 REST API Broken Object-Level Authorization via Bank Account Routes
- dolibarr
- Broken access control
- CVSS 7.2 High
Dolibarr < 24.0.0 Payments REST API Improper Authorization via Delete Endpoint
- dolibarr
- Broken access control
- CVSS 7.1 High
Dolibarr < 24.0.0 REST API Broken Object-Level Authorization via Third-Party Write Route
- dolibarr
- Broken access control
- CVSS 8.6 High
Dolibarr < 24.0.0 Members REST API Improper Authorization via Password Reset
- dolibarr
- Broken access control
- CVSS 5.1 Medium
Dolibarr < 24.0.0 Reflected XSS via Extra Fields Administration Template
- dolibarr
- Cross-site scripting (XSS)
- CVSS 5.3 Medium
Dolibarr Account card.php improper authorization
- Dolibarr
- Privilege escalation
- Broken access control
- CVSS 5.3 Medium
Dolibarr User Cloning card.php ldap injection
- Dolibarr
- Other injection
- CVSS 7.2 High
Dolibarr - SQL Injection via sqlfilters Parameter in Multiple REST API List Endpoints
- dolibarr
- SQL injection
- CVSS 8.6 High
Dolibarr has an Authenticated Remote Code Execution via eval() injection in user extrafields
- dolibarr
- Other injection
- CVSS 5.1 Medium
Dolibarr 11.0.3 - 'ldap.php' - Persistent Cross-Site Scripting
- Dolibarr
- Cross-site scripting (XSS)
-
dolibarr: Dolibarr ERP/CRM 3.3.1 does not properly validate user input in viewimage.php and…
- dolibarr
-
dolibarr: Cross-site Scripting (XSS) in Dolibarr ERP/CRM 3.3.1 allows remote attackers to inject…
- dolibarr
-
dolibarr: SQL injection vulnerability in Dolibarr ERP/CRM 3.3.1 allows remote attackers to execute…
- dolibarr