CVE-2019-25710

Dolibarr ERP-CRM 8.0.4 SQL Injection via rowid Parameter

High8.8Public exploitEPSS 0.31%

Published: 12 Apr 2026
Updated: 8 Oct 2026
Reserved: 12 Apr 2026
Assigned by: VulnCheck

Description

Dolibarr ERP-CRM 8.0.4 contains an SQL injection vulnerability in the rowid parameter of the admin dict.php endpoint that allows attackers to execute arbitrary SQL queries. Attackers can inject malicious SQL code through the rowid POST parameter to extract sensitive database information using error-based SQL injection techniques.

Public exploit

A reference of the record is tagged as an exploit or proof of concept: anyone can try it against an unpatched system.

ExploitDB-46095 (opens in a new tab)exploit

Timeline

2026
12 Apr 2026
12 Apr 2026
ID reserved
By VulnCheck
12 Apr 2026
12 Apr 2026
Published
8 Oct 20266 months later
8 Oct 2026· 6 months later
Record updated

Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.

Scores

CVSS scores of CVE-2019-25710, by who scored it
Scored by	CVSS	Score	Vector
VulnCheckCNA (assigner)	4.0	High8.8	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N
VulnCheckCNA (assigner)	3.1	High8.2	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
NVDNVD · Analyzed	4.0	High8.8	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

EPSS (exploitation in 30 days): 0.31% · top 76% of all CVEs (7 Nov 2026)
CISA SSVC: Exploitation: none · Automatable: yes · Technical impact: partial

The list uses the assigner's score when there is one, then CISA's, then NVD's: High 8.8.

Weakness

CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (opens in a new tab)All about CWE-89 and its CVEs

Affected products

Dolibarr · Dolibarr ERP-CRM
- affected 8.0.4

Affected packages

From reviewed advisories of the GitHub Advisory Database.

Packagistdolibarr/dolibarrGHSA-xxxg-x793-7fq3 (opens in a new tab)

References (4)

ExploitDB-46095 (opens in a new tab)exploit
Official Product Homepage (opens in a new tab)product
Product Reference (opens in a new tab)product
VulnCheck Advisory: Dolibarr ERP-CRM 8.0.4 SQL Injection via rowid Parameter (opens in a new tab)third-party-advisory

Sources

The same CVE in the primary databases and aggregators, to check against.

Badge for a README or a ticket

[![CVE-2019-25710](https://trackcve.app/badge/CVE-2019-25710.svg)](https://trackcve.app/cve/CVE-2019-25710)

Record last updated 8 Oct 2026, 15:20 UTC.