Dolibarr security vulnerabilities
CMS / eCommerce / ERP. Public CVE monitoring for Dolibarr. Vendor security advisories are linked on this page.
Built for Operators of this product.
55 public records · 0 security-fix timeline events. 0 published in the last 7 days. 43 store a version range.
What you can do here
Current vulnerabilities
KEV-first priority plus newest publications for this stack.
Verified security fixes
Timeline events and, for Odoo, Community Git patch evidence — not keyword-only guesses.
Monitoring
Watch this technology from your account when you want alerts on new matches.
Patch intelligence
Use version checkers and advisory links to confirm upgrades before you change production.
- Critical 0
- High 3
- Medium 1
- Low 0
2026-08-094 issues2026-11-06
Known exploited
View all known exploitedRecently published
Browse catalog- High8.8Dolibarr has SQL Injection in societe/class/societe.class.php via localtax1_value parameterCheck if you run itEPSS 0.51%Oct 27, 2026
- Medium5.3A vulnerability has been found in Dolibarr up to 23.0.2.Check if you run itEPSS 0.36%Oct 19, 2026
- Medium5.3A vulnerability has been found in Dolibarr ERP CRM 23.0.0/23.0.1/23.0.2.Check if you run itEPSS 0.22%May 31, 2026
- High8.6Dolibarr is an enterprise resource planning (ERP) and customer relationship management (CRM) software package.Check if you run itEPSS 0.88%May 8, 2026
- Critical9.4Dolibarr is an enterprise resource planning (ERP) and customer relationship management (CRM) software package.Check if you run itEPSS 0.92%Apr 17, 2026
- High8.8Dolibarr ERP-CRM 8.0.4 contains an SQL injection vulnerability in the rowid parameter of the admin dict.php endpoint that allows attackers to execute arbitrary SQL queries.Check if you run itEPSS 0.31%Apr 12, 2026
- Medium6.5Dolibarr is an enterprise resource planning (ERP) and customer relationship management (CRM) software package.Check if you run itEPSS 1.46%Mar 27, 2026
- Critical9.0Cross Site Request Forgery vulnerability in Dolibarr ERP & CRM v.22.0.9 allows a remote attacker to escalate privileges via the notes field in perms.php NOTE: this is disputed by aCheck if you run itEPSS 0.17%Feb 12, 2026
- Medium5.1Dolibarr 11.0.3 contains a persistent cross-site scripting vulnerability in LDAP synchronization settings that allows attackers to inject malicious scripts through multiple parametCheck if you run itEPSS 0.29%Jan 30, 2026
- High8.4Dolibarr ERP-CRM 14.0.2 contains a stored cross-site scripting vulnerability in the ticket creation module that allows low-privilege users to inject malicious scripts.Check if you run itEPSS 0.35%Jan 15, 2026