- Products & ServicesProducts & Services
- SolutionsSolutions
- PricingPricing
- CompanyCompany
- ResourcesResources
en
en
As of 09/14/2026, Dolibarr recorded 19 security vulnerabilities in the last 90 days across 2 products, including 14 rated High or above and 0 known exploited vulnerabilities (KEV) that should be prioritized for immediate remediation.
Over the last 90 days, Dolibarr had the most security vulnerabilities in the Dolibarr ecosystem, with 17 vulnerabilities—approximately 89.47% of the provider's total vulnerabilities during this period.
| Vulnerability | Exploitation status | Fix | Affected product | Published | Severity |
|---|---|---|---|---|---|
CVE-2026-89013Dolibarr 23.0.4 < 24.0.1 Authorization Bypass via hashp Parameter in document.php | Exploitation statusNot known exploited | FixYes | Affected productDolibarr | Published09/11/2026 | SeverityHigh |
CVE-2026-89012Dolibarr 24.0.0 < 24.0.1 SQL Filter Denylist Bypass via sqlfilters Parameter | Exploitation statusNot known exploited | FixYes | Affected productDolibarr | Published09/11/2026 | SeverityHigh |
CVE-2026-82633Dolibarr 10.0.0 before 24.0.0 Missing Authorization on REST Users Groups Endpoint | Exploitation statusNot known exploited | FixYes | Affected productDolibarr | Published08/30/2026 | SeverityMedium |
CVE-2026-81730Dolibarr 9.0.0 through 23.0.4 Path Traversal via EmailCollector Attachment Filename | Exploitation statusNot known exploited | FixYes | Affected productDolibarr | Published08/27/2026 | SeverityHigh |
CVE-2026-81729Dolibarr before 23.0.4 Incorrect Authorization on REST API Document Deletion | Exploitation statusNot known exploited | FixYes | Affected productDolibarr | Published08/27/2026 | SeverityHigh |
CVE-2026-81728Dolibarr before 24.0.0 SQL Injection via the CSV and XLSX Import Update Keys | Exploitation statusNot known exploited | FixYes | Affected productDolibarr | Published08/27/2026 | SeverityHigh |
CVE-2026-77923Dolibarr 21.0.0 < 24.0.0 Authorization Bypass via clonetasks Mass Action | Exploitation statusNot known exploited | FixYes | Affected productDolibarr | Published08/24/2026 | SeverityMedium |
CVE-2026-71511Dolibarr < 24.0.0 Members REST API Sensitive Data Exposure via Member Endpoints | Exploitation statusPublic exploit | FixYes | Affected productDolibarr | Published08/24/2026 | SeverityHigh |
CVE-2026-71510Dolibarr < 24.0.0 Users REST API SQL Injection via filter parameter | Exploitation statusPublic exploit | FixYes | Affected productDolibarr | Published08/24/2026 | SeverityHigh |
CVE-2026-71509Dolibarr < 24.0.0 Expense Report REST API Improper Authorization via Update Endpoint | Exploitation statusPublic exploit | FixYes | Affected productDolibarr | Published08/24/2026 | SeverityHigh |
CVE-2026-71508Dolibarr < 24.0.0 REST API Improper Authorization via User Update Endpoint | Exploitation statusPublic exploit | FixYes | Affected productDolibarr | Published08/24/2026 | SeverityHigh |
CVE-2026-71507Dolibarr < 24.0.0 REST API Broken Object-Level Authorization via Bank Account Routes | Exploitation statusPublic exploit | FixYes | Affected productDolibarr | Published08/24/2026 | SeverityHigh |
CVE-2026-71506Dolibarr < 24.0.0 Payments REST API Improper Authorization via Delete Endpoint | Exploitation statusPublic exploit | FixYes | Affected productDolibarr | Published08/24/2026 | SeverityHigh |
CVE-2026-71505Dolibarr < 24.0.0 REST API Broken Object-Level Authorization via Third-Party Write Route | Exploitation statusPublic exploit | FixYes | Affected productDolibarr | Published08/24/2026 | SeverityHigh |
CVE-2026-71504Dolibarr < 24.0.0 Members REST API Improper Authorization via Password Reset | Exploitation statusPublic exploit | FixYes | Affected productDolibarr | Published08/24/2026 | SeverityHigh |
CVE-2026-71503Dolibarr < 24.0.0 Reflected XSS via Extra Fields Administration Template | Exploitation statusPublic exploit | FixYes | Affected productDolibarr | Published08/24/2026 | SeverityMedium |
CVE-2026-78160Dolibarr ERP User Notes note.php authorization | Exploitation statusNot known exploited | FixYes | Affected productERP | Published08/24/2026 | SeverityMedium |
CVE-2026-73692 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published08/18/2026 | SeverityUnknown |
CVE-2026-19350Dolibarr ERP TakePOS invoice.php fail authorization | Exploitation statusPublic exploit | FixYes | Affected productERP | Published08/09/2026 | SeverityMedium |
CVE-2026-58376Dolibarr - SQL Injection via sqlfilters Parameter in Multiple REST API List Endpoints | Exploitation statusPublic exploit | FixYes | Affected productDolibarr | Published06/30/2026 | SeverityHigh |
CVE-2026-11619Dolibarr ERP CRM Legacy Filemanager config.inc.php improper authorization | Exploitation statusPublic exploit | FixYes | Affected productERP CRM | Published06/09/2026 | SeverityMedium |
CVE-2026-10215Dolibarr ERP CRM Leave Request REST API api_holidays.class.php checkUserAccessToObject improper authorization | Exploitation statusPublic exploit | FixYes | Affected productERP CRM | Published06/01/2026 | SeverityMedium |
CVE-2026-10154Dolibarr ERP CRM messaging.php authorization | Exploitation statusPublic exploit | FixYes | Affected productERP CRM | Published05/30/2026 | SeverityMedium |
CVE-2018-25357Dolibarr ERP CRM 7.0.3 Remote Code Execution via install/step1.php | Exploitation statusPublic exploit | FixNot confirmed | Affected productDolibarr ERP CRM | Published05/23/2026 | SeverityCritical |
CVE-2025-67486Dolibarr has an Authenticated Remote Code Execution via eval() injection in user extrafields | Exploitation statusPublic exploit | FixNot confirmed | Affected productDolibarr | Published05/08/2026 | SeverityHigh |
CVE-2026-7689Dolibarr ERP CRM Online Signature security.lib.php dol_verifyHash signature verification | Exploitation statusPublic exploit | FixNot confirmed | Affected productERP CRM | Published05/03/2026 | SeverityMedium |
CVE-2026-7688Dolibarr ERP CRM Shipments API Endpoint expedition.class.php _checkValForAPI sql injection | Exploitation statusPublic exploit | FixNot confirmed | Affected productERP CRM | Published05/03/2026 | SeverityLow |
CVE-2026-31019 | Exploitation statusNot known exploited | FixNot confirmed | Affected productNot confirmed | Published04/21/2026 | SeverityHigh |
CVE-2026-31018 | Exploitation statusNot known exploited | FixNot confirmed | Affected productNot confirmed | Published04/21/2026 | SeverityHigh |
CVE-2026-23500Dolibarr: OS Command Injection (RCE) via MAIN_ODT_AS_PDF configuration | Exploitation statusPublic exploit | FixYes | Affected productDolibarr | Published04/17/2026 | SeverityCritical |
CVE-2019-25710Dolibarr ERP-CRM 8.0.4 SQL Injection via rowid Parameter | Exploitation statusPublic exploit | FixNot confirmed | Affected productDolibarr ERP-CRM | Published04/12/2026 | SeverityHigh |
CVE-2026-22666Dolibarr ERP/CRM < 23.0.2 Authenticated RCE via dol_eval_standard() | Exploitation statusPublic exploit | FixYes | Affected productDolibarr ERP CRM | Published04/07/2026 | SeverityHigh |
CVE-2026-34036Dolibarr Core Discloses Sensitive Data via Authenticated Local File Inclusion in selectobject.php | Exploitation statusPublic exploit | FixNot confirmed | Affected productDolibarr | Published03/31/2026 | SeverityMedium |
CVE-2019-25452Dolibarr ERP/CRM 10.0.1 SQL Injection via elemid | Exploitation statusPublic exploit | FixNot confirmed | Affected productDolibarr ERP CRM | Published02/22/2026 | SeverityHigh |
CVE-2019-25450Dolibarr ERP/CRM 10.0.1 SQL Injection via card.php | Exploitation statusPublic exploit | FixNot confirmed | Affected productDolibarr ERP CRM | Published02/22/2026 | SeverityHigh |
CVE-2020-36966Dolibarr 11.0.3 - 'ldap.php' - Persistent Cross-Site Scripting | Exploitation statusPublic exploit | FixNot confirmed | Affected productDolibarr | Published01/30/2026 | SeverityMedium |
CVE-2021-47779Dolibarr ERP-CRM 14.0.2 - Stored Cross-Site Scripting (XSS) / Privilege Escalation | Exploitation statusPublic exploit | FixNot confirmed | Affected productCRM | Published01/15/2026 | SeverityHigh |
CVE-2025-56588 | Exploitation statusNot known exploited | FixNot confirmed | Affected productNot confirmed | Published10/01/2025 | SeverityHigh |
CVE-2024-55227 | Exploitation statusPublic exploit | FixNot confirmed | Affected productNot confirmed | Published01/27/2025 | SeverityCritical |
CVE-2024-55228 | Exploitation statusPublic exploit | FixNot confirmed | Affected productNot confirmed | Published01/27/2025 | SeverityCritical |
CVE-2021-3991Improper Authorization in dolibarr/dolibarr | Exploitation statusPublic exploit | FixYes | Affected productdolibarr/dolibarr | Published11/15/2024 | SeverityMedium |
CVE-2024-37821 | Exploitation statusNot known exploited | FixNot confirmed | Affected productNot confirmed | Published06/18/2024 | SeverityHigh |
CVE-2024-5315Multiple vulnerabilities in DOLIBARR's ERP CMS | Exploitation statusNot known exploited | FixYes | Affected productERP CMS | Published05/24/2024 | SeverityCritical |
CVE-2024-5314Multiple vulnerabilities in DOLIBARR's ERP CMS | Exploitation statusNot known exploited | FixYes | Affected productERP CMS | Published05/24/2024 | SeverityCritical |
CVE-2024-31503 | Exploitation statusNot known exploited | FixNot confirmed | Affected productNot confirmed | Published04/16/2024 | SeverityHigh |
CVE-2024-29477 | Exploitation statusNot known exploited | FixNot confirmed | Affected productNot confirmed | Published04/03/2024 | SeverityHigh |
CVE-2024-23817Dolibarr Application Home Page HTML injection vulnerability | Exploitation statusPublic exploit | FixNot confirmed | Affected productDolibarr | Published01/25/2024 | SeverityHigh |
CVE-2023-4198Dolibarr ERP CRM (<= 17.0.3) Improper Access Control | Exploitation statusPublic exploit | FixYes | Affected productDolibarr ERP CRM | Published11/01/2023 | SeverityMedium |
CVE-2023-4197Dolibarr ERP CRM (<= 18.0.1) Improper Input Sanitization Authenticated RCE | Exploitation statusPublic exploit | FixYes | Affected productDolibarr ERP CRM | Published11/01/2023 | SeverityHigh |
CVE-2023-5842Cross-site Scripting (XSS) - Stored in dolibarr/dolibarr | Exploitation statusPublic exploit | FixYes | Affected productdolibarr/dolibarr | Published10/30/2023 | SeverityMedium |
CVE-2023-5323Cross-site Scripting (XSS) - Generic in dolibarr/dolibarr | Exploitation statusPublic exploit | FixYes | Affected productdolibarr/dolibarr | Published10/01/2023 | SeverityMedium |
CVE-2023-38887 | Exploitation statusPublic exploit | FixNot confirmed | Affected productNot confirmed | Published09/20/2023 | SeverityHigh |
CVE-2023-38886 | Exploitation statusPublic exploit | FixNot confirmed | Affected productNot confirmed | Published09/20/2023 | SeverityUnknown |
CVE-2023-38888 | Exploitation statusPublic exploit | FixNot confirmed | Affected productNot confirmed | Published09/20/2023 | SeverityUnknown |
CVE-2023-33568 | Exploitation statusPublic exploit | FixNot confirmed | Affected productNot confirmed | Published06/13/2023 | SeverityUnknown |
CVE-2023-30253 | Exploitation statusPublic exploit | FixNot confirmed | Affected productNot confirmed | Published05/29/2023 | SeverityHigh |
CVE-2022-4093SQL Injection in dolibarr/dolibarr | Exploitation statusPublic exploit | FixYes | Affected productdolibarr/dolibarr | Published11/21/2022 | SeverityHigh |
CVE-2022-43138 | Exploitation statusPublic exploit | FixNot confirmed | Affected productNot confirmed | Published11/17/2022 | SeverityCritical |
CVE-2022-40871 | Exploitation statusNot known exploited | FixNot confirmed | Affected productNot confirmed | Published10/12/2022 | SeverityCritical |
CVE-2022-2060Cross-site Scripting (XSS) - Stored in dolibarr/dolibarr | Exploitation statusNot confirmed | FixYes | Affected productdolibarr/dolibarr | Published06/13/2022 | SeverityHigh |
CVE-2022-30875 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published06/08/2022 | SeverityUnknown |
CVE-2021-37517 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published03/31/2022 | SeverityUnknown |
CVE-2021-36625 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published03/31/2022 | SeverityUnknown |
CVE-2022-0819Code Injection in dolibarr/dolibarr | Exploitation statusNot confirmed | FixYes | Affected productdolibarr/dolibarr | Published03/02/2022 | SeverityHigh |
CVE-2022-0746Business Logic Errors in dolibarr/dolibarr | Exploitation statusNot confirmed | FixYes | Affected productdolibarr/dolibarr | Published02/25/2022 | SeverityMedium |
CVE-2022-0731Improper Access Control (IDOR) in dolibarr/dolibarr | Exploitation statusNot confirmed | FixYes | Affected productdolibarr/dolibarr | Published02/23/2022 | SeverityMedium |
CVE-2022-0414Improper Validation of Specified Quantity in Input in dolibarr/dolibarr | Exploitation statusNot confirmed | FixYes | Affected productdolibarr/dolibarr | Published01/31/2022 | SeverityMedium |
CVE-2022-0224SQL Injection in dolibarr/dolibarr | Exploitation statusNot confirmed | FixYes | Affected productdolibarr/dolibarr | Published01/14/2022 | SeverityHigh |
CVE-2022-0174Improper Validation of Specified Quantity in Input in dolibarr/dolibarr | Exploitation statusNot confirmed | FixYes | Affected productdolibarr/dolibarr | Published01/10/2022 | SeverityMedium |
CVE-2022-22293 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published01/01/2022 | SeverityUnknown |
CVE-2021-42220 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published12/15/2021 | SeverityUnknown |
CVE-2021-33618 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published11/10/2021 | SeverityUnknown |
CVE-2021-33816 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published11/10/2021 | SeverityUnknown |
CVE-2021-25956Improper User Access Control in "Dolibarr" Leads to Account Takeover | Exploitation statusNot confirmed | FixYes | Affected productDolibarr | Published08/17/2021 | SeverityMedium |
CVE-2021-25957Account Takeover in "Dolibarr" via Password Reset Functionality | Exploitation statusNot confirmed | FixYes | Affected productDolibarr | Published08/17/2021 | SeverityHigh |
CVE-2021-25955Stored XSS in “Dolibarr” leads to privilege escalation | Exploitation statusNot confirmed | FixYes | Affected productDolibarr | Published08/15/2021 | SeverityCritical |
CVE-2021-25954Improper Access Control in “Dolibarr” | Exploitation statusNot confirmed | FixYes | Affected productDolibarr | Published08/09/2021 | SeverityMedium |
CVE-2020-35136 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published12/23/2020 | SeverityUnknown |
CVE-2020-14209 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published09/02/2020 | SeverityUnknown |
CVE-2020-13828 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published08/31/2020 | SeverityUnknown |
CVE-2020-14201 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published08/21/2020 | SeverityUnknown |
CVE-2020-14475 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published06/19/2020 | SeverityUnknown |
CVE-2020-14443 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published06/18/2020 | SeverityUnknown |
CVE-2020-13239 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published05/20/2020 | SeverityUnknown |
CVE-2020-13240 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published05/20/2020 | SeverityUnknown |
CVE-2020-13094 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published05/18/2020 | SeverityUnknown |
CVE-2020-12669 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published05/06/2020 | SeverityUnknown |
CVE-2020-11825 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published04/16/2020 | SeverityUnknown |
CVE-2020-11823 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published04/16/2020 | SeverityUnknown |
CVE-2019-19212 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published03/16/2020 | SeverityUnknown |
CVE-2019-19211 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published03/16/2020 | SeverityUnknown |
CVE-2019-19210 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published03/16/2020 | SeverityUnknown |
CVE-2019-19209 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published03/16/2020 | SeverityUnknown |
CVE-2020-9016 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published02/16/2020 | SeverityUnknown |
CVE-2020-7994 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published01/26/2020 | SeverityUnknown |
CVE-2020-7995 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published01/26/2020 | SeverityUnknown |
CVE-2020-7996 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published01/26/2020 | SeverityUnknown |
CVE-2019-19206 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published11/26/2019 | SeverityUnknown |
CVE-2013-2093 | Exploitation statusNot confirmed | FixNot confirmed | Affected productDolibarr | Published11/20/2019 | SeverityUnknown |
CVE-2013-2092 | Exploitation statusNot confirmed | FixNot confirmed | Affected productDolibarr | Published11/20/2019 | SeverityUnknown |
CyStack VulnScan continuously discovers assets, validates vulnerabilities, and helps security teams prioritize remediation across the organization.
Explore CyStack VulnScan