Filtered by vendor Dolibarr Subscriptions
Filtered by product Dolibarr Erp/crm Subscriptions

Search

Switch to Advanced Search (Beta)
Total 7 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2019-25710 1 Dolibarr 2 Dolibarr Erp/crm, Dolibarr Erp\/crm 2026-04-17 8.2 High
Dolibarr ERP-CRM 8.0.4 contains an SQL injection vulnerability in the rowid parameter of the admin dict.php endpoint that allows attackers to execute arbitrary SQL queries. Attackers can inject malicious SQL code through the rowid POST parameter to extract sensitive database information using error-based SQL injection techniques.
CVE-2012-10059 1 Dolibarr 2 Dolibarr, Dolibarr Erp/crm 2026-04-15 N/A
Dolibarr ERP/CRM versions <= 3.1.1 and <= 3.2.0 contain a post-authenticated OS command injection vulnerability in its database backup feature. The export.php script fails to sanitize the sql_compat parameter, allowing authenticated users to inject arbitrary system commands, resulting in remote code execution on the server.
CVE-2026-22666 1 Dolibarr 1 Dolibarr Erp/crm 2026-04-08 7.2 High
Dolibarr ERP/CRM versions prior to 23.0.2 contain an authenticated remote code execution vulnerability in the dol_eval_standard() function that fails to apply forbidden string checks in whitelist mode and does not detect PHP dynamic callable syntax. Attackers with administrator privileges can inject malicious payloads through computed extrafields or other evaluation paths using PHP dynamic callable syntax to bypass validation and achieve arbitrary command execution via eval().
CVE-2021-47779 1 Dolibarr 3 Dolibarr, Dolibarr Erp/crm, Dolibarr Erp\/crm 2026-04-07 5.4 Medium
Dolibarr ERP-CRM 14.0.2 contains a stored cross-site scripting vulnerability in the ticket creation module that allows low-privilege users to inject malicious scripts. Attackers can craft a specially designed ticket message with embedded JavaScript that triggers when an administrator copies the text, potentially enabling privilege escalation.
CVE-2019-25452 1 Dolibarr 2 Dolibarr Erp/crm, Dolibarr Erp\/crm 2026-04-07 7.5 High
Dolibarr ERP/CRM 10.0.1 contains an SQL injection vulnerability in the elemid POST parameter of the viewcat.php endpoint that allows unauthenticated attackers to execute arbitrary SQL queries. Attackers can submit crafted POST requests with malicious SQL payloads in the elemid parameter to extract sensitive database information using error-based or time-based blind SQL injection techniques.
CVE-2019-25450 1 Dolibarr 2 Dolibarr Erp/crm, Dolibarr Erp\/crm 2026-04-07 7.5 High
Dolibarr ERP/CRM 10.0.1 contains multiple SQL injection vulnerabilities that allow authenticated attackers to manipulate database queries by injecting SQL code through POST parameters. Attackers can inject malicious SQL through parameters like actioncode, demand_reason_id, and availability_id in card.php endpoints to extract sensitive database information using boolean-based blind, error-based, and time-based blind techniques.
CVE-2025-56588 1 Dolibarr 3 Dolibarr, Dolibarr Erp/crm, Dolibarr Erp\/crm 2025-10-22 8.8 High
Dolibarr ERP & CRM v21.0.1 were discovered to contain a remote code execution (RCE) vulnerability in the User module configuration via the computed field parameter.