Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
20 results
Oct 28, 2026Dolibarr ERP CRM before 24.0.2 contains a missing authorization vulnerability in htdocs/public/recruitment/view.php that allows unauthenticated attackers to vieCVE-2026-118754 · Other software · Dolibarr · reported by VulnCheckMedium 6.9
Dolibarr ERP CRM before 24.0.2 contains a missing authorization vulnerability in htdocs/public/recruitment/view.php that allows unauthenticated attackers to view unpublished draft job positions. Attackers can enumerate sequential provisional references via the ref parameter to read titles, descriptions, salary budgets, and recruiter names and emails.
- Product
- Dolibarr ERP/CRM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 26, 2026Dolibarr ERP CRM before 24.0.0 contains an OS command injection vulnerability in htdocs/admin/tools/export.php that lets authenticated administrators bypass theCVE-2026-116219 · Other software · Dolibarr · reported by VulnCheckHigh 8.6
Dolibarr ERP CRM before 24.0.0 contains an OS command injection vulnerability in htdocs/admin/tools/export.php that lets authenticated administrators bypass the restrict_os_commands allowlist. Attackers can submit a mysqldump value chaining commands with & characters around an allowlisted basename to execute operating system commands as the web server user.
- Product
- dolibarr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 26, 2026Dolibarr ERP CRM 19.0.0 before 23.0.4 contains an SQL injection vulnerability that allows authenticated API users to inject SQL via the type field of the third-CVE-2026-116218 · Other software · Dolibarr · reported by VulnCheckHigh 7.2
Dolibarr ERP CRM 19.0.0 before 23.0.4 contains an SQL injection vulnerability that allows authenticated API users to inject SQL via the type field of the third-party bankaccounts REST endpoint. Attackers with only societe/creer permission can break out of the unescaped type value in CompanyBankAccount::create() to read password hashes and API keys via time-based blind subqueries.
- Product
- dolibarr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 8, 2026Dolibarr ERP CRM before 24.0.2 contains an incorrect authorization vulnerability in htdocs/core/ajax/updateextrafield.php that checks only read permission beforCVE-2026-107706 · Other software · Dolibarr · reported by VulnCheckMedium 5.3
Dolibarr ERP CRM before 24.0.2 contains an incorrect authorization vulnerability in htdocs/core/ajax/updateextrafield.php that checks only read permission before writing extrafield values. Authenticated users with read-only access can POST objectType, objectId, field and value parameters to persistently modify extrafields on viewable third parties, products, members, projects or contacts.
- Product
- dolibarr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 8, 2026A vulnerability was identified in Dolibarr ERP CRM up to 23.0.2.CVE-2026-11619 · Other software · Dolibarr · reported by VulDBLow 2.1
A vulnerability was identified in Dolibarr ERP CRM up to 23.0.2. The impacted element is an unknown function of the file htdocs/core/filemanagerdol/connectors/php/config.inc.php of the component Legacy Filemanager. The manipulation leads to improper authorization. It is possible to initiate the attack remotely. The exploit is publicly available and might be used. Upgrading to version 23.0.3 is sufficient to resolve this issue. The identifier of the patch is f1b2dd6481e22cacb561d29ffdcd3a50b618479d. Upgrading the affected component is advised.
- Product
- ERP CRM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 31, 2026A security vulnerability has been detected in Dolibarr ERP CRM up to 23.0.1.CVE-2026-10215 · Other software · Dolibarr · reported by VulDBLow 2.1
A security vulnerability has been detected in Dolibarr ERP CRM up to 23.0.1. Impacted is the function checkUserAccessToObject of the file htdocs/holiday/class/api_holidays.class.php of the component Leave Request REST API. The manipulation leads to improper authorization. The attack may be initiated remotely. The exploit has been disclosed publicly and may be used. Upgrading to version 23.0.2 is recommended to address this issue. The identifier of the patch is ee93b6f2f9dd0f6aeefe9d718ab3ab0a44326b73. Upgrading the affected component is advised.
- Product
- ERP CRM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 30, 2026A vulnerability has been found in Dolibarr ERP CRM 23.0.0/23.0.1/23.0.2.CVE-2026-10154 · Other software · Dolibarr · reported by VulDBMedium 5.3
A vulnerability has been found in Dolibarr ERP CRM 23.0.0/23.0.1/23.0.2. The affected element is an unknown function of the file htdocs/user/messaging.php. Such manipulation of the argument ID leads to authorization bypass. The attack can be executed remotely. Upgrading to version 23.0.3 is sufficient to fix this issue. The name of the patch is 119b3606c7a701747a57a1f18b1a9e7666f678e2. It is suggested to upgrade the affected component.
- Product
- ERP CRM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 23, 2026Dolibarr ERP CRM 7.0.3 contains a remote code execution vulnerability that allows unauthenticated attackers to execute arbitrary code by injecting PHP code throCVE-2018-25357 · Other software · Dolibarr · reported by VulnCheckCritical 9.3
Dolibarr ERP CRM 7.0.3 contains a remote code execution vulnerability that allows unauthenticated attackers to execute arbitrary code by injecting PHP code through the db_name parameter. Attackers can send a POST request to install/step1.php with malicious PHP code in the db_name parameter, then execute commands via the check.php endpoint using the cmd GET parameter.
- Product
- Dolibarr ERP CRM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddolibarr.orggithub.com
May 3, 2026A security flaw has been discovered in Dolibarr ERP CRM up to 23.0.2.CVE-2026-7689 · Other software · Dolibarr · reported by VulDBLow 2.9
A security flaw has been discovered in Dolibarr ERP CRM up to 23.0.2. This vulnerability affects the function dol_verifyHash in the library htdocs/core/lib/security.lib.php of the component Online Signature Module. The manipulation results in improper verification of cryptographic signature. The attack may be performed from remote. Attacks of this nature are highly complex. It is stated that the exploitability is difficult. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- ERP CRM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comvuldb.com
May 3, 2026A vulnerability was identified in Dolibarr ERP CRM up to 23.0.2.CVE-2026-7688 · Other software · Dolibarr · reported by VulDBLow 1.3
A vulnerability was identified in Dolibarr ERP CRM up to 23.0.2. This affects the function _checkValForAPI of the file htdocs/expedition/class/expedition.class.php of the component Shipments API Endpoint. The manipulation of the argument fields leads to sql injection. The attack is possible to be carried out remotely. A high degree of complexity is needed for the attack. It is indicated that the exploitability is difficult. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- ERP CRM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 24, 2024Dolibarr ERP CRM before 19.0.2-php8.2 was discovered to contain a remote code execution (RCE) vulnerability via the Computed field parameter under the Users ModCVE-2024-40137 · Other software · dolibarr · reported by MITREMedium 5.5
Dolibarr ERP CRM before 19.0.2-php8.2 was discovered to contain a remote code execution (RCE) vulnerability via the Computed field parameter under the Users Module Setup function.
- Product
- dolibarr_erp\/crm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 18, 2024An arbitrary file upload vulnerability in the Upload Template function of Dolibarr ERP CRM up to v19.0.1 allows attackers to execute arbitrary code via uploadinCVE-2024-37821 · Other software · dolibarr · reported by MITREHigh 8.8
An arbitrary file upload vulnerability in the Upload Template function of Dolibarr ERP CRM up to v19.0.1 allows attackers to execute arbitrary code via uploading a crafted .SQL file.
- Product
- dolibarr_erp\/crm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 16, 2024Incorrect access control in Dolibarr ERP CRM versions 19.0.0 and before, allows authenticated attackers to steal victim users' session cookies and CSRF protectiCVE-2024-31503 · Other software · dolibarr · reported by MITREHigh 7.5
Incorrect access control in Dolibarr ERP CRM versions 19.0.0 and before, allows authenticated attackers to steal victim users' session cookies and CSRF protection tokens via user interaction with a crafted web page, leading to account takeover.
- Product
- dolibarr_erp\/crm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 3, 2024Lack of sanitization during Installation Process in Dolibarr ERP CRM up to version 19.0.0 allows an attacker with adjacent access to the network to execute arbiCVE-2024-29477 · Other software · Dolibarr · reported by MITREHigh 8.8
Lack of sanitization during Installation Process in Dolibarr ERP CRM up to version 19.0.0 allows an attacker with adjacent access to the network to execute arbitrary code via a specifically crafted input.
- Product
- Dolibarr Erp/crm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 1, 2023Improper Access Control in Dolibarr ERP CRM <= v17.0.3 allows an unauthorized authenticated user to read a database table containing customer dataCVE-2023-4198 · Other software · Dolibarr · reported by info@starlabs.sgMedium 6.5
Improper Access Control in Dolibarr ERP CRM <= v17.0.3 allows an unauthorized authenticated user to read a database table containing customer data
- Product
- Dolibarr ERP CRM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 1, 2023Improper input validation in Dolibarr ERP CRM <= v18.0.1 fails to strip certain PHP code from user-supplied input when creating a Website, allowing an attacker CVE-2023-4197 · Other software · Dolibarr · reported by info@starlabs.sgHigh 7.5
Improper input validation in Dolibarr ERP CRM <= v18.0.1 fails to strip certain PHP code from user-supplied input when creating a Website, allowing an attacker to inject and evaluate arbitrary PHP code.
- Product
- Dolibarr ERP CRM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 19, 2023Cross Site Scripting vulnerability in Dolibarr ERP CRM v.17.0.1 and before allows a remote attacker to obtain sensitive information and execute arbitrary code vCVE-2023-38888 · Other software · Dolibarr · reported by MITRECritical 9.6
Cross Site Scripting vulnerability in Dolibarr ERP CRM v.17.0.1 and before allows a remote attacker to obtain sensitive information and execute arbitrary code via the REST API module, related to analyseVarsForSqlAndScriptsInjection and testSqlAndScriptInject.
- Product
- Dolibarr Erp/crm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 19, 2023File Upload vulnerability in Dolibarr ERP CRM v.17.0.1 and before allows a remote attacker to execute arbitrary code and obtain sensitive information via the exCVE-2023-38887 · Other software · Dolibarr · reported by MITREHigh 8.8
File Upload vulnerability in Dolibarr ERP CRM v.17.0.1 and before allows a remote attacker to execute arbitrary code and obtain sensitive information via the extension filtering and renaming functions.
- Product
- Dolibarr Erp/crm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 19, 2023An issue in Dolibarr ERP CRM v.17.0.1 and before allows a remote privileged attacker to execute arbitrary code via a crafted command/script.CVE-2023-38886 · Other software · Dolibarr · reported by MITREHigh 7.2
An issue in Dolibarr ERP CRM v.17.0.1 and before allows a remote privileged attacker to execute arbitrary code via a crafted command/script.
- Product
- Dolibarr Erp/crm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 15, 2021In “Dolibarr ERP CRM”, WYSIWYG Editor module, v2.8.1 to v13.0.2 are affected by a stored XSS vulnerability that allows low privileged application users to storeCVE-2021-25955 · Other software · Dolibarr · reported by vulnerabilitylab@mend.ioCritical 9
In “Dolibarr ERP CRM”, WYSIWYG Editor module, v2.8.1 to v13.0.2 are affected by a stored XSS vulnerability that allows low privileged application users to store malicious scripts in the “Private Note” field at “/adherents/note.php?id=1” endpoint. These scripts are executed in a victim’s browser when they open the page containing the vulnerable field. In the worst case, the victim who inadvertently triggers the attack is a highly privileged administrator. The injected scripts can extract the Session ID, which can lead to full Account takeover of the admin and due to other vulnerability (Improper Access Control on Private notes) a low privileged user can update the private notes which could lead to privilege escalation.
- Product
- dolibarr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comwhitesourcesoftware.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.