Known Vulnerabilities for Dolibarr ERP/CRM by Dolibarr
Listed below are 10 of the newest known vulnerabilities associated with "Dolibarr ERP/CRM" by "Dolibarr".
These CVEs are retrieved based on exact matches on listed software, hardware, and vendor information (CPE data) as well as a keyword search to ensure the newest vulnerabilities with no officially listed software information are still displayed.
Data on known vulnerable versions is also displayed based on information from known CPEs
Known Vulnerabilities
| CVE | Shortened Description | Severity | Publish Date | Last Modified |
|---|---|---|---|---|
| CVE-2026-116219 json | Dolibarr ERP CRM before 24.0.0 contains an OS command injection vulnerability in htdocs/admin/tools/export.php that lets auth... | Not Provided | 2026-10-26 | 2026-10-26 |
| CVE-2026-116218 json | Dolibarr ERP CRM 19.0.0 before 23.0.4 contains an SQL injection vulnerability that allows authenticated API users to inject S... | Not Provided | 2026-10-26 | 2026-10-26 |
| CVE-2026-112361 json | A vulnerability has been found in Dolibarr up to 23.0.2. The impacted element is an unknown function of the file htdocs/docum... | Not Provided | 2026-10-19 | 2026-10-20 |
| CVE-2026-110874 json | Dolibarr before 23.0.4 contains a PHP object injection vulnerability in jsonOrUnserialize() in functions.lib.php, which calls... | Not Provided | 2026-10-15 | 2026-10-15 |
| CVE-2026-107706 json | Dolibarr ERP CRM before 24.0.2 contains an incorrect authorization vulnerability in htdocs/core/ajax/updateextrafield.php tha... | Not Provided | 2026-10-08 | 2026-10-08 |
| CVE-2026-89013 json | Dolibarr 23.0.4 before 24.0.1 contains an authorization bypass vulnerability that allows unauthenticated attackers to read ar... | Not Provided | 2026-09-11 | 2026-09-17 |
| CVE-2026-89012 json | Dolibarr 24.0.0 before 24.0.1 contains a case-sensitive denylist bypass vulnerability in the sqlfilters API query parameter t... | Not Provided | 2026-09-11 | 2026-09-11 |
| CVE-2026-85401 json | A weakness has been identified in Dolibarr up to 21.0.4/22.0.5/23.0.3. Affected by this issue is some unknown functionality o... | Not Provided | 2026-09-04 | 2026-09-04 |
| CVE-2026-82633 json | Dolibarr versions 10.0.0 before 24.0.0 fail to perform per-object authorization checks in the Users::getGroups REST API endpo... | Not Provided | 2026-08-30 | 2026-08-31 |
| CVE-2026-81730 json | Dolibarr 9.0.0 through 23.0.4 saves inbound email attachments under the name supplied in the message's MIME headers without r... | Not Provided | 2026-08-27 | 2026-08-28 |
Known Affected Configurations (CPE V2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Application | Dolibarr | Dolibarr Erp/crm | 9.0.3 | |||
| Application | Dolibarr | Dolibarr Erp/crm | 9.0.2 | |||
| Application | Dolibarr | Dolibarr Erp/crm | 9.0.1 | |||
| Application | Dolibarr | Dolibarr Erp/crm | 9.0.0 | |||
| Application | Dolibarr | Dolibarr Erp/crm | 8.0.5 | |||
| Application | Dolibarr | Dolibarr Erp/crm | 8.0.4 | |||
| Application | Dolibarr | Dolibarr Erp/crm | 8.0.3 | |||
| Application | Dolibarr | Dolibarr Erp/crm | 8.0.2 | |||
| Application | Dolibarr | Dolibarr Erp/crm | 8.0.1 | |||
| Application | Dolibarr | Dolibarr Erp/crm | 8.0.0 | |||
| Application | Dolibarr | Dolibarr Erp/crm | 7.0.5 | |||
| Application | Dolibarr | Dolibarr Erp/crm | 7.0.4 | |||
| Application | Dolibarr | Dolibarr Erp/crm | 7.0.3 | |||
| Application | Dolibarr | Dolibarr Erp/crm | 7.0.2 | |||
| Application | Dolibarr | Dolibarr Erp/crm | 7.0.1 | |||
| Application | Dolibarr | Dolibarr Erp/crm | 7.0.0 | |||
| Application | Dolibarr | Dolibarr Erp/crm | 6.0.8 | |||
| Application | Dolibarr | Dolibarr Erp/crm | 6.0.7 | |||
| Application | Dolibarr | Dolibarr Erp/crm | 6.0.6 | |||
| Application | Dolibarr | Dolibarr Erp/crm | 6.0.5 |