- Products & ServicesProducts & Services
- SolutionsSolutions
- PricingPricing
- CompanyCompany
- ResourcesResources
en
en
A short verification protects source data and prevents automated AI requests.
Verifying...
As of 11/08/2026, Dolibarr ERP/CRM recorded 1 security vulnerability in the last 90 days, of which 0 are rated High or Critical. None of these vulnerabilities is actively exploited (KEV) according to CISA's catalog. CyStack recommends that organizations and individual users apply patches as soon as possible.
CyStack does not yet have sufficient official-source data to identify the latest version of Dolibarr ERP/CRM and determine which vulnerabilities affect that version.
CyStack VulnScan continuously discovers assets, validates vulnerabilities, and helps security teams prioritize remediation across the organization.
CVE-2026-118754Dolibarr ERP CRM before 24.0.2 Missing Authorization via public recruitment view.phpCVE-2018-25357Dolibarr ERP CRM 7.0.3 Remote Code Execution via install/step1.phpCVE-2026-22666Dolibarr ERP/CRM < 23.0.2 Authenticated RCE via dol_eval_standard()CVE-2019-25452Dolibarr ERP/CRM 10.0.1 SQL Injection via elemidCVE-2019-25450Dolibarr ERP/CRM 10.0.1 SQL Injection via card.php| Vulnerability | Exploitation status | Fix | Published | Severity |
|---|---|---|---|---|
CVE-2026-118754Dolibarr ERP CRM before 24.0.2 Missing Authorization via public recruitment view.php | Exploitation statusActively exploited | FixYes | Published10/28/2026 | SeverityMedium |
CVE-2018-25357Dolibarr ERP CRM 7.0.3 Remote Code Execution via install/step1.php | Exploitation statusActively exploited | FixNo | Published05/23/2026 | SeverityCritical |
CVE-2026-22666Dolibarr ERP/CRM < 23.0.2 Authenticated RCE via dol_eval_standard() | Exploitation statusActively exploited | FixYes | Published04/07/2026 | SeverityHigh |
CVE-2019-25452Dolibarr ERP/CRM 10.0.1 SQL Injection via elemid | Exploitation statusActively exploited | FixNo | Published02/22/2026 | SeverityHigh |
CVE-2019-25450Dolibarr ERP/CRM 10.0.1 SQL Injection via card.php | Exploitation statusActively exploited | FixNo | Published02/22/2026 | SeverityHigh |
CVE-2023-4198Dolibarr ERP CRM (<= 17.0.3) Improper Access Control | Exploitation statusActively exploited | FixYes | Published11/01/2023 | SeverityMedium |
CVE-2023-4197Dolibarr ERP CRM (<= 18.0.1) Improper Input Sanitization Authenticated RCE | Exploitation statusActively exploited | FixYes | Published11/01/2023 | SeverityHigh |
7 Results | Page 1 of 1