Skip to content
OpenAdvisories

Vendor

Dolibarr

66 known vulnerabilities.

Products

dolibarr 36 dolibarr/dolibarr 11 Dolibarr ERP/CRM 8 ERP CRM 6 ERP CMS 2 ERP 2 CRM 1
All Critical High Medium Low Exploited only Public exploit

6 results · Clear filters · Feed

  • Critical 9.8
    CVE-2018-25357

    Dolibarr ERP CRM 7.0.3 Remote Code Execution via install/step1.php

    Dolibarr ERP CRM 7.0.3 contains a remote code execution vulnerability that allows unauthenticated attackers to execute arbitrary code by injecting PHP code through the db_name parameter. Attackers can send a POST request to install/step1.php with malicious PH…

    Dolibarr Dolibarr ERP/CRM dolibarr dolibarr/dolibarr Ubuntu Packagist
  • Critical 9.4
    CVE-2026-23500 Public exploit

    Dolibarr: OS Command Injection (RCE) via MAIN_ODT_AS_PDF configuration

    Dolibarr is an enterprise resource planning (ERP) and customer relationship management (CRM) software package. In versions prior to 23.0.0 , the ODT to PDF conversion process in odf.php concatenates the MAIN_ODT_AS_PDF configuration constant directly into a s…

    Dolibarr dolibarr dolibarr dolibarr/dolibarr Ubuntu Packagist
  • Critical 9.4
    CVE-2012-10059 Public exploit

    Dolibarr ERP/CRM Post-Auth OS Command Injection

    Dolibarr ERP/CRM versions <= 3.1.1 and <= 3.2.0 contain a post-authenticated OS command injection vulnerability in its database backup feature. The export.php script fails to sanitize the sql_compat parameter, allowing authenticated users to inject arbitrary …

    Dolibarr ERP CRM dolibarr Ubuntu
  • Critical 9.1
    CVE-2024-5315 Scanner template EPSS 35%

    Multiple vulnerabilities in DOLIBARR's ERP CMS

    Vulnerabilities in Dolibarr ERP - CRM that affect version 9.0.1 and allow SQL injection. These vulnerabilities could allow a remote attacker to send a specially crafted SQL query to the system and retrieve all the information stored in the database through th…

    Dolibarr ERP CMS dolibarr dolibarr/dolibarr Ubuntu Packagist
  • Critical 9.1
    CVE-2024-5314

    Multiple vulnerabilities in DOLIBARR's ERP CMS

    Vulnerabilities in Dolibarr ERP - CRM that affect version 9.0.1 and allow SQL injection. These vulnerabilities could allow a remote attacker to send a specially crafted SQL query to the system and retrieve all the information stored in the database through th…

    Dolibarr ERP CMS dolibarr dolibarr/dolibarr Ubuntu Packagist
  • Critical 9.0
    CVE-2021-25955

    Stored XSS in “Dolibarr” leads to privilege escalation

    In “Dolibarr ERP CRM”, WYSIWYG Editor module, v2.8.1 to v13.0.2 are affected by a stored XSS vulnerability that allows low privileged application users to store malicious scripts in the “Private Note” field at “/adherents/note.php?id=1” endpoint. These script…

    Dolibarr dolibarr dolibarr dolibarr/dolibarr Ubuntu Packagist