Dolibarr vulnerabilities
Filtered catalog for this technology stack. Use KEV and EPSS sorting to prioritize — then open each CVE for remediation and version matching.
55 matching records
- High7.2In “Dolibarr” application, v3.3.beta1_20121221 to v13.0.2 have “Modify” access for admin level users to change other user’s details but fails to validate already exist…Check if you run itEPSS 0.94%Aug 17, 2021
- Critical9.0In “Dolibarr ERP CRM”, WYSIWYG Editor module, v2.8.1 to v13.0.2 are affected by a stored XSS vulnerability that allows low privileged application users to store malici…Check if you run itEPSS 0.89%Aug 15, 2021
- Medium4.3In “Dolibarr” application, 2.8.1 to 13.0.4 don’t restrict or incorrectly restricts access to a resource from an unauthorized actor.Check if you run itEPSS 0.70%Aug 9, 2021
- High8.8Dolibarr before 11.0.5 allows low-privilege users to upload files of dangerous types, leading to arbitrary code execution.Check this weekEPSS 27.48%Sep 2, 2020
- Medium6.5Dolibarr CRM before 11.0.5 allows privilege escalation.Check if you run itEPSS 1.63%Aug 21, 2020
- High8.8A SQL injection vulnerability in accountancy/customer/card.php in Dolibarr 11.0.3 allows remote authenticated users to execute arbitrary SQL commands via the id parameter.Check if you run itEPSS 1.15%Jun 18, 2020
- Medium5.4Dolibarr before 11.0.4 allows XSS.Check if you run itEPSS 1.15%May 18, 2020
- High8.8core/get_menudiv.php in Dolibarr before 11.0.4 allows remote authenticated attackers to bypass intended access restrictions via a non-alphanumeric menu parameter.Check if you run itEPSS 1.96%May 6, 2020
- Critical9.8Dolibarr ERP/CRM 3.0 through 10.0.3 allows XSS via the qty parameter to product/fournisseurs.php (product price screen).Check if you run itEPSS 3.89%Mar 16, 2020
- Medium6.1Dolibarr ERP/CRM before 10.0.3 has an Insufficient Filtering issue that can lead to user/card.php XSS.Check if you run itEPSS 1.67%Mar 16, 2020
- Medium5.4Dolibarr ERP/CRM before 10.0.3 allows XSS because uploaded HTML documents are served as text/html despite being renamed to .noexe files.Check if you run itEPSS 0.93%Mar 16, 2020
- High7.5Dolibarr ERP/CRM before 10.0.3 allows SQL Injection.Check if you run itEPSS 2.08%Mar 16, 2020
- Critical9.8CVE-2018-16809 is listed by An issue was discovered in Dolibarr through 7.0.0..Check if you run itEPSS 2.26%Mar 7, 2019
- Medium6.1CVE-2018-16808 is listed by An issue was discovered in Dolibarr through 7.0.0..Check if you run itEPSS 0.98%Mar 7, 2019
- Medium6.1Dolibarr ERP/CRM through 8.0.3 has /exports/export.php?datatoexport= XSS.Check if you run itEPSS 4.48%Dec 26, 2018
- Critical9.8SQL Injection vulnerability in Dolibarr before version 7.0.2 allows remote attackers to execute arbitrary SQL commands via the sortfield parameter to /accountancy/admi…Check if you run itEPSS 3.77%May 22, 2018
- Medium6.1Cross-site scripting (XSS) vulnerability in Dolibarr before 7.0.2 allows remote attackers to inject arbitrary web script or HTML via the foruserlogin parameter to adhe…Check this weekEPSS 86.51%May 22, 2018
- Critical9.8SQL injection vulnerability in Dolibarr before 7.0.2 allows remote attackers to execute arbitrary SQL commands via vectors involving integer parameters without quotes.Check this weekEPSS 69.34%May 22, 2018
- High8.0The admin panel in Dolibarr before 7.0.2 might allow remote attackers to execute arbitrary commands by leveraging support for updating the antivirus command and parame…Check if you run itEPSS 1.97%May 22, 2018
- Critical9.8SQL injection vulnerability in don/list.php in Dolibarr version 6.0.0 allows remote attackers to execute arbitrary SQL commands via the statut parameter.Check if you run itEPSS 1.31%Sep 11, 2017
- Medium5.4Cross-site scripting (XSS) vulnerability in Dolibarr ERP/CRM 6.0.0 allows remote authenticated users to inject arbitrary web script or HTML via the Title parameter to…Check if you run itEPSS 0.72%Sep 11, 2017
- High7.5There is a sensitive information disclosure vulnerability in document.php in Dolibarr ERP/CRM version 6.0.0 via the file parameter.Check if you run itEPSS 1.16%Sep 11, 2017
- Medium5.4Multiple cross-site scripting (XSS) vulnerabilities in Dolibarr ERP/CRM 6.0.0 allow remote authenticated users to inject arbitrary web script or HTML via the (1) Compa…Check if you run itEPSS 0.72%Sep 11, 2017
- Critical9.8SQL injection vulnerability in admin/menus/edit.php in Dolibarr ERP/CRM version 6.0.0 allows remote attackers to execute arbitrary SQL commands via the menuId parameter.Check if you run itEPSS 1.31%Sep 11, 2017
- High8.8Dolibarr ERP/CRM 5.0.3 and prior allows low-privilege users to upload files of dangerous types, which can result in arbitrary code execution within the context of the…Check if you run itEPSS 1.46%Jun 25, 2017