Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

dolibarr — Vulnerabilities & Security Advisories 35

All 35 CVE vulnerabilities found in dolibarr, with AI-generated Chinese analysis, references, and POCs.

This page aggregates security vulnerabilities associated with the product dolibarr, focusing specifically on its vulnerability history and related weakness types. It collects disclosed security flaws, such as injection flaws, authentication errors, and memory issues, covering advisories published over the past several years. Users can track vendor-issued security notices, explore specific weakness classes like cross-site scripting or buffer overflows, and review the complete vulnerability timeline for this application. The dataset includes details on affected versions, severity ratings, and patch availability without listing individual CVE identifiers. This resource supports security teams in monitoring updates and assessing risk exposure for instances running dolibarr.

Vendor: dolibarr

CVE ID Title CVSS Severity Published
CVE-2026-107706 Dolibarr before 24.0.2 Incorrect Authorization via updateextrafield.php CWE-863 4.3 Medium 2026-10-08
CVE-2026-89013 Dolibarr 23.0.4 < 24.0.1 Authorization Bypass via hashp Parameter in document.php CWE-863 7.5 High 2026-09-11
CVE-2026-89012 Dolibarr 24.0.0 < 24.0.1 SQL Filter Denylist Bypass via sqlfilters Parameter CWE-178 6.5 Medium 2026-09-11
CVE-2026-85401 Dolibarr Legacy File Manager config.inc.php access control CWE-284 6.3 Medium 2026-09-04
CVE-2026-82633 Dolibarr 10.0.0 before 24.0.0 Missing Authorization on REST Users Groups Endpoint CWE-862 4.3 Medium 2026-08-30
CVE-2026-81730 Dolibarr 9.0.0 through 23.0.4 Path Traversal via EmailCollector Attachment Filename CWE-22 8.2 High 2026-08-27
CVE-2026-81728 Dolibarr before 24.0.0 SQL Injection via the CSV and XLSX Import Update Keys CWE-89 8.1 High 2026-08-27
CVE-2026-81729 Dolibarr before 23.0.4 Incorrect Authorization on REST API Document Deletion CWE-863 6.5 Medium 2026-08-27
CVE-2026-77923 Dolibarr 21.0.0 < 24.0.0 Authorization Bypass via clonetasks Mass Action CWE-863 4.3 Medium 2026-08-24
CVE-2026-71511 Dolibarr < 24.0.0 Members REST API Sensitive Data Exposure via Member Endpoints CWE-522 6.5 Medium 2026-08-24
CVE-2026-71510 Dolibarr < 24.0.0 Users REST API SQL Injection via filter parameter CWE-863 6.5 Medium 2026-08-24
CVE-2026-71509 Dolibarr < 24.0.0 Expense Report REST API Improper Authorization via Update Endpoint CWE-862 6.5 Medium 2026-08-24
CVE-2026-71508 Dolibarr < 24.0.0 REST API Improper Authorization via User Update Endpoint CWE-862 6.5 Medium 2026-08-24
CVE-2026-71507 Dolibarr < 24.0.0 REST API Broken Object-Level Authorization via Bank Account Routes CWE-639 6.5 Medium 2026-08-24
CVE-2026-71506 Dolibarr < 24.0.0 Payments REST API Improper Authorization via Delete Endpoint CWE-863 8.1 High 2026-08-24
CVE-2026-71505 Dolibarr < 24.0.0 REST API Broken Object-Level Authorization via Third-Party Write Route CWE-639 7.1 High 2026-08-24
CVE-2026-71504 Dolibarr < 24.0.0 Members REST API Improper Authorization via Password Reset CWE-862 8.1 High 2026-08-24
CVE-2026-71503 Dolibarr < 24.0.0 Reflected XSS via Extra Fields Administration Template CWE-79 6.1 Medium 2026-08-24
CVE-2026-77686 Dolibarr Account card.php improper authorization CWE-285 5.4 Medium 2026-08-21
CVE-2026-19930 Dolibarr User Cloning card.php ldap injection CWE-90 6.3 Medium 2026-08-16
CVE-2026-58376 Dolibarr - SQL Injection via sqlfilters Parameter in Multiple REST API List Endpoints CWE-89 7.6 High 2026-06-30
CVE-2025-67486 Dolibarr has an Authenticated Remote Code Execution via eval() injection in user extrafields CWE-74 7.2AI High AI 2026-05-08
CVE-2026-23500 Dolibarr: OS Command Injection (RCE) via MAIN_ODT_AS_PDF configuration CWE-78 7.2AI High AI 2026-04-17
CVE-2026-34036 Dolibarr Core Discloses Sensitive Data via Authenticated Local File Inclusion in selectobject.php CWE-98 6.5 Medium 2026-03-31
CVE-2020-36966 Dolibarr 11.0.3 - 'ldap.php' - Persistent Cross-Site Scripting CWE-79 6.4 Medium 2026-01-30
CVE-2024-23817 Dolibarr Application Home Page HTML injection vulnerability CWE-79 7.1 High 2024-01-25
CVE-2021-25956 Improper User Access Control in "Dolibarr" Leads to Account Takeover CWE-284 4.7 Medium 2021-08-17
CVE-2021-25957 Account Takeover in "Dolibarr" via Password Reset Functionality CWE-640 8.8 High 2021-08-17
CVE-2021-25955 Stored XSS in “Dolibarr” leads to privilege escalation CWE-79 9.0 Critical 2021-08-15
CVE-2021-25954 Improper Access Control in “Dolibarr” CWE-284 4.3 Medium 2021-08-09

All 35 known CVE vulnerabilities affecting dolibarr with full Chinese analysis, references, and POCs where available.