Dolibarr vulnerabilities

CVEs per yearBy the year they were published

1. 20193
2. 20214
3. 20228
4. 20234
5. 20244
6. 202639

Newest CVEs

• CVE-2026-118754

  Dolibarr ERP CRM before 24.0.2 Missing Authorization via public recruitment view.php

  Dolibarr · Dolibarr ERP/CRM

  Medium6.9
• CVE-2026-116219

  Dolibarr ERP CRM before 24.0.0 OS Command Injection via mysqldump Parameter

  Dolibarr · dolibarr

  High8.6
• CVE-2026-116218

  Dolibarr ERP CRM 19.0.0 before 23.0.4 SQL Injection via bankaccounts API type field

  Dolibarr · dolibarr

  High7.2
• CVE-2026-110874

  Dolibarr before 23.0.4 PHP Object Injection via jsonOrUnserialize()

  Dolibarr · dolibarr

  High7.5
• CVE-2026-107706

  Dolibarr before 24.0.2 Incorrect Authorization via updateextrafield.php

  Dolibarr · dolibarr

  Medium5.3
• CVE-2026-89013

  Dolibarr 23.0.4 < 24.0.1 Authorization Bypass via hashp Parameter in document.php

  Dolibarr · Dolibarr

  High8.7
• CVE-2026-89012

  Dolibarr 24.0.0 < 24.0.1 SQL Filter Denylist Bypass via sqlfilters Parameter

  Dolibarr · Dolibarr

  High7.1
• CVE-2026-82633

  Dolibarr 10.0.0 before 24.0.0 Missing Authorization on REST Users Groups Endpoint

  Dolibarr · dolibarr

  Medium5.3
• CVE-2026-81730

  Dolibarr 9.0.0 through 23.0.4 Path Traversal via EmailCollector Attachment Filename

  Dolibarr · dolibarr

  High8.8
• CVE-2026-81729

  Dolibarr before 23.0.4 Incorrect Authorization on REST API Document Deletion

  Dolibarr · dolibarr

  High7.1