Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
77 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
Dolibarr ERP CRM 7.0.3 contains a remote code evaluation vulnerability that allows unauthenticated attackers to execute arbitrary code by injecting PHP code through the dbname parameter. Attackers can send a POST request to install/step1.php with malicious PHP code in the dbname parameter, then execute commands via the check.php endpoint using the cmd GET parameter.
Recommended action: Upgrade to 7.0.4 or 6.0.8 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Authenticated Local File Inclusion (LFI) via selectobject.php leading to sensitive data disclosure Target Dolibarr Core (Tested on version 22.0.4) Summary A Local File Inclusion (LFI) vulnerability has been discovered in the core AJAX endpoint `/core/ajax/selectobject.php`. By manipulating the `objectdesc` parameter and exploiting a fail-open logic flaw in the core access control function `restrictedArea()`, an authenticated user with no specific privileges can read the contents of arbitrary non-PHP files on the server (such as `.env`, `.htaccess`, configuration backups, or logs…). Vulnerability Details The vulnerability is caused by a critical design flaw in `/core/ajax/selectobject.php` where dynamic file inclusion occurs before any access control checks are performed, combined with a fail-open logic in the core ACL function. - Arbitrary File Inclusion BEFORE Authorization: The endpoint parses the `objectdesc` parameter into a `$classpath`. If…
Recommended action: Upgrade to 23.0.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Dolibarr ERP & CRM v21.0.1 were discovered to contain a remote code execution (RCE) vulnerability in the User module configuration via the computed field parameter.
Recommended action: Upgrade to 21.0.3 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
An Improper Authorization vulnerability exists in Dolibarr versions prior to version 15.0.0. A user with restricted permissions in the 'Reception' section is able to access specific reception details via direct URL access, bypassing the intended permission restrictions.
Recommended action: Upgrade to 15.0.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Dolibarr ERP CRM before 19.0.2 was discovered to contain a remote code execution (RCE) vulnerability via the Computed field parameter under the Users Module Setup function.
Recommended action: Upgrade to 19.0.2 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
An arbitrary file upload vulnerability in the Upload Template function of Dolibarr ERP CRM up to v19.0.1 allows attackers to execute arbitrary code via uploading a crafted .SQL file.
Recommended action: Upgrade to 19.0.2 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
A Reflected Cross-site scripting (XSS) vulnerability located in htdocs/compta/paiement/card.php of Dolibarr before 19.0.2 allows remote attackers to inject arbitrary web script or HTML via a crafted payload injected into the facid parameter.
Recommended action: Upgrade to 19.0.2 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Observed a HTML Injection vulnerbaility in the Home page of Dolibarr Application. This vulnerability allows an attacker to inject arbitrary HTML tags and manipulate the rendered content in the application's response. Specifically, I was able to successfully inject a new HTML tag into the returned document and, as a result, was able to comment out some part of the Dolibarr App Home page HTML code. This behavior can be exploited to perform various attacks like Cross-Site Scripting (XSS). Details 1. Navigate to the login page of Dolibarr application. 2. Submit a login request with the following payload in an arbitrarily supplied body parameter: "u70ea%22%3e%3c!--HTMLInjectionBySai"=1 HTTP Post Request: POST /dolibarr/index.php?mainmenu=home HTTP/1.1 Host: 192.168.37.129 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language:…
Recommended action: Upgrade to 18.0.7 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Improper Access Control in Dolibarr ERP CRM <= v17.0.3 allows an unauthorized authenticated user to read a database table containing customer data
Recommended action: Upgrade to 18.0.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Improper input validation in Dolibarr ERP CRM <= v18.0.1 fails to strip certain PHP code from user-supplied input when creating a Website, allowing an attacker to inject and evaluate arbitrary PHP code.
Recommended action: Upgrade to 18.0.2 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Cross-site Scripting (XSS) - Stored in GitHub repository dolibarr/dolibarr prior to 16.0.5.
Recommended action: Upgrade to 16.0.5 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Cross-site Scripting (XSS) - Generic in GitHub repository dolibarr/dolibarr prior to 18.0.0.
Recommended action: Upgrade to 18.0.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
File Upload vulnerability in Dolibarr ERP CRM v.17.0.1 and before allows a remote attacker to execute arbitrary code and obtain sensitive information via the extension filtering and renaming functions.
Recommended action: Upgrade to 17.0.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Cross Site Scripting vulnerability in Dolibarr ERP CRM v.17.0.1 and before allows a remote attacker to obtain sensitive information and execute arbitrary code via the REST API module, related to analyseVarsForSqlAndScriptsInjection and testSqlAndScriptInject.
Recommended action: Upgrade to 17.0.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
An issue in Dolibarr ERP CRM v.17.0.1 and before allows a remote privileged attacker to execute arbitrary code via a crafted command/script.
Recommended action: Upgrade to 17.0.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
An issue in Dolibarr v16.0.0 to v16.0.5 allows unauthenticated attackers to perform a database dump and access a company's entire customer file, prospects, suppliers, and employee information if a contact file exists.
Recommended action: Upgrade to 16.0.5 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Dolibarr before 17.0.1 allows remote code execution by an authenticated user via an uppercase manipulation: <?PHP instead of <?php in injected data.
Recommended action: Upgrade to 17.0.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
SQL injection attacks can result in unauthorized access to sensitive data, such as passwords, credit card details, or personal user information. Many high-profile data breaches in recent years have been the result of SQL injection attacks, leading to reputational damage and regulatory fines. In some cases, an attacker can obtain a persistent backdoor into an organization's systems, leading to a long-term compromise that can go unnoticed for an extended period. This affect 16.0.1 and 16.0.2 only. 16.0.0 or lower, and 16.0.3 or higher are not affected
Recommended action: Upgrade to 16.0.3 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Dolibarr Open Source ERP & CRM for Business before v14.0.1 allows attackers to escalate privileges via a crafted API.
Recommended action: Upgrade to 14.0.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
A Cross-site Scripting (XSS) vulnerability exists in the admin/accountant.php file. The fields town, name, and Accountant code can be used to escape double quote protection.
Recommended action: Upgrade to 16.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
The website builder module in Dolibarr 13.0.2 allows remote PHP code execution because of an incomplete protection mechanism in which system, exec, and shellexec are blocked but backticks are not blocked.
Recommended action: Upgrade to 14.0.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Dolibarr 12.0.3 is vulnerable to authenticated Remote Code Execution. An attacker who has the access the admin dashboard can manipulate the backup function by inserting a payload into the filename for the zipfilenametemplate parameter to admin/tools/dolibarrexport.php.
Recommended action: Upgrade to 12.0.4 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Dolibarr before 11.0.5 allows low-privilege users to upload files of dangerous types, leading to arbitrary code execution. This occurs because .pht and .phar files can be uploaded. Also, a .htaccess file can be uploaded to reconfigure access control (e.g., to let .noexe files be executed as PHP code to defeat the .noexe protection mechanism).
Recommended action: Upgrade to 11.0.5 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Dolibarr CRM before 11.0.5 allows privilege escalation. This could allow remote authenticated attackers to upload arbitrary files via societe/document.php in which "disabled" is changed to "enabled" in the HTML source code.
Recommended action: Upgrade to 11.0.5 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
A reflected cross-site scripting (XSS) vulnerability in Dolibarr 11.0.4 and below allows remote attackers to inject arbitrary web script or HTML into public/notice.php (related to transphrase and transkey).
Recommended action: Upgrade to 11.0.5 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.