Dolibarr

Source repositories

https://github.com/dolibarr/dolibarr

CVEs (152)

CVE	Vendor / Product	Sev	Risk	CVSS	EPSS	Published	Description
CVE-2022-0224	Dolibarr Dolibarr	Cri	0.57	9.8	0.02	Jan 14, 2022	dolibarr is vulnerable to Improper Neutralization of Special Elements used in an SQL Command
CVE-2020-11825	Dolibarr Dolibarr	Hig	0.57	8.8	0.01	Apr 16, 2020	In Dolibarr 10.0.6, forms are protected with a CSRF token against CSRF attacks. The problem is any CSRF token in any user's session can be used in another user's session. CSRF tokens should not be valid in this situation.
CVE-2013-2093	Dolibarr Dolibarr	Cri	0.57	9.8	0.05	Nov 20, 2019	Dolibarr ERP/CRM 3.3.1 does not properly validate user input in viewimage.php and barcode.lib.php which allows remote attackers to execute arbitrary commands.
CVE-2013-2091	Dolibarr Dolibarr	Cri	0.57	9.8	0.03	Nov 20, 2019	SQL injection vulnerability in Dolibarr ERP/CRM 3.3.1 allows remote attackers to execute arbitrary SQL commands via the 'pays' parameter in fiche.php.
CVE-2019-1010054	Dolibarr Dolibarr	Hig	0.57	8.8	0.02	Jul 18, 2019	Dolibarr 7.0.0 is affected by: Cross Site Request Forgery (CSRF). The impact is: allow malitious html to change user password, disable users and disable password encryptation. The component is: Function User password change, user disable and password encryptation. The attack…
CVE-2018-13450	Dolibarr Dolibarr	Cri	0.57	9.8	0.02	Jul 8, 2018	SQL injection vulnerability in product/card.php in Dolibarr ERP/CRM version 7.0.3 allows remote attackers to execute arbitrary SQL commands via the status_batch parameter.
CVE-2018-13449	Dolibarr Dolibarr	Cri	0.57	9.8	0.02	Jul 8, 2018	SQL injection vulnerability in product/card.php in Dolibarr ERP/CRM version 7.0.3 allows remote attackers to execute arbitrary SQL commands via the statut_buy parameter.
CVE-2018-13448	Dolibarr Dolibarr	Cri	0.57	9.8	0.02	Jul 8, 2018	SQL injection vulnerability in product/card.php in Dolibarr ERP/CRM version 7.0.3 allows remote attackers to execute arbitrary SQL commands via the country_id parameter.
CVE-2018-13447	Dolibarr Dolibarr	Cri	0.57	9.8	0.02	Jul 8, 2018	SQL injection vulnerability in product/card.php in Dolibarr ERP/CRM version 7.0.3 allows remote attackers to execute arbitrary SQL commands via the statut parameter.
CVE-2018-9019	Dolibarr Dolibarr	Cri	0.57	9.8	0.04	May 22, 2018	SQL Injection vulnerability in Dolibarr before version 7.0.2 allows remote attackers to execute arbitrary SQL commands via the sortfield parameter to /accountancy/admin/accountmodel.php, /accountancy/admin/categories_list.php, /accountancy/admin/journals_list.php,…
CVE-2017-9839	Dolibarr Dolibarr	Hig	0.57	8.8	0.01	Apr 11, 2018	Dolibarr ERP/CRM is affected by SQL injection in versions before 5.0.4 via product/stats/card.php (type parameter).
CVE-2017-18260	Dolibarr Dolibarr	Hig	0.57	8.8	0.01	Apr 11, 2018	Dolibarr ERP/CRM is affected by multiple SQL injection vulnerabilities in versions through 7.0.0 via comm/propal/list.php (viewstatut parameter) or comm/propal/list.php (propal_statut parameter, aka search_statut parameter).
CVE-2017-17900	Dolibarr Dolibarr	Cri	0.57	9.8	0.02	Dec 27, 2017	SQL injection vulnerability in fourn/index.php in Dolibarr ERP/CRM version 6.0.4 allows remote attackers to execute arbitrary SQL commands via the socid parameter.
CVE-2017-17899	Dolibarr Dolibarr	Cri	0.57	9.8	0.02	Dec 27, 2017	SQL injection vulnerability in adherents/subscription/info.php in Dolibarr ERP/CRM version 6.0.4 allows remote attackers to execute arbitrary SQL commands via the rowid parameter.
CVE-2017-17897	Dolibarr Dolibarr	Cri	0.57	9.8	0.02	Dec 27, 2017	SQL injection vulnerability in comm/multiprix.php in Dolibarr ERP/CRM version 6.0.4 allows remote attackers to execute arbitrary SQL commands via the id parameter.
CVE-2017-14242	Dolibarr Dolibarr	Cri	0.57	9.8	0.01	Sep 11, 2017	SQL injection vulnerability in don/list.php in Dolibarr version 6.0.0 allows remote attackers to execute arbitrary SQL commands via the statut parameter.
CVE-2017-14238	Dolibarr Dolibarr	Cri	0.57	9.8	0.01	Sep 11, 2017	SQL injection vulnerability in admin/menus/edit.php in Dolibarr ERP/CRM version 6.0.0 allows remote attackers to execute arbitrary SQL commands via the menuId parameter.
CVE-2017-9840	Dolibarr Dolibarr	Hig	0.57	8.8	0.01	Jun 25, 2017	Dolibarr ERP/CRM 5.0.3 and prior allows low-privilege users to upload files of dangerous types, which can result in arbitrary code execution within the context of the vulnerable application.
CVE-2017-9435	Dolibarr Dolibarr	Cri	0.57	9.8	0.01	Jun 5, 2017	Dolibarr ERP/CRM before 5.0.3 is vulnerable to a SQL injection in user/index.php (search_supervisor and search_statut parameters).
CVE-2020-14209	Dolibarr Dolibarr	Hig	0.55	8.8	0.27	Sep 2, 2020	Dolibarr before 11.0.5 allows low-privilege users to upload files of dangerous types, leading to arbitrary code execution. This occurs because .pht and .phar files can be uploaded. Also, a .htaccess file can be uploaded to reconfigure access control (e.g., to let .noexe files be…

CVE-2022-0224CriJan 14, 2022
Dolibarr
Dolibarr
risk 0.57cvss 9.8epss 0.02
dolibarr is vulnerable to Improper Neutralization of Special Elements used in an SQL Command
CVE-2020-11825HigApr 16, 2020
Dolibarr
Dolibarr
risk 0.57cvss 8.8epss 0.01
In Dolibarr 10.0.6, forms are protected with a CSRF token against CSRF attacks. The problem is any CSRF token in any user's session can be used in another user's session. CSRF tokens should not be valid in this situation.
CVE-2013-2093CriNov 20, 2019
Dolibarr
Dolibarr
risk 0.57cvss 9.8epss 0.05
Dolibarr ERP/CRM 3.3.1 does not properly validate user input in viewimage.php and barcode.lib.php which allows remote attackers to execute arbitrary commands.
CVE-2013-2091CriNov 20, 2019
Dolibarr
Dolibarr
risk 0.57cvss 9.8epss 0.03
SQL injection vulnerability in Dolibarr ERP/CRM 3.3.1 allows remote attackers to execute arbitrary SQL commands via the 'pays' parameter in fiche.php.
CVE-2019-1010054HigJul 18, 2019
Dolibarr
Dolibarr
risk 0.57cvss 8.8epss 0.02
Dolibarr 7.0.0 is affected by: Cross Site Request Forgery (CSRF). The impact is: allow malitious html to change user password, disable users and disable password encryptation. The component is: Function User password change, user disable and password encryptation. The attack…
CVE-2018-13450CriJul 8, 2018
Dolibarr
Dolibarr
risk 0.57cvss 9.8epss 0.02
SQL injection vulnerability in product/card.php in Dolibarr ERP/CRM version 7.0.3 allows remote attackers to execute arbitrary SQL commands via the status_batch parameter.
CVE-2018-13449CriJul 8, 2018
Dolibarr
Dolibarr
risk 0.57cvss 9.8epss 0.02
SQL injection vulnerability in product/card.php in Dolibarr ERP/CRM version 7.0.3 allows remote attackers to execute arbitrary SQL commands via the statut_buy parameter.
CVE-2018-13448CriJul 8, 2018
Dolibarr
Dolibarr
risk 0.57cvss 9.8epss 0.02
SQL injection vulnerability in product/card.php in Dolibarr ERP/CRM version 7.0.3 allows remote attackers to execute arbitrary SQL commands via the country_id parameter.
CVE-2018-13447CriJul 8, 2018
Dolibarr
Dolibarr
risk 0.57cvss 9.8epss 0.02
SQL injection vulnerability in product/card.php in Dolibarr ERP/CRM version 7.0.3 allows remote attackers to execute arbitrary SQL commands via the statut parameter.
CVE-2018-9019CriMay 22, 2018
Dolibarr
Dolibarr
risk 0.57cvss 9.8epss 0.04
SQL Injection vulnerability in Dolibarr before version 7.0.2 allows remote attackers to execute arbitrary SQL commands via the sortfield parameter to /accountancy/admin/accountmodel.php, /accountancy/admin/categories_list.php, /accountancy/admin/journals_list.php,…
CVE-2017-9839HigApr 11, 2018
Dolibarr
Dolibarr
risk 0.57cvss 8.8epss 0.01
Dolibarr ERP/CRM is affected by SQL injection in versions before 5.0.4 via product/stats/card.php (type parameter).
CVE-2017-18260HigApr 11, 2018
Dolibarr
Dolibarr
risk 0.57cvss 8.8epss 0.01
Dolibarr ERP/CRM is affected by multiple SQL injection vulnerabilities in versions through 7.0.0 via comm/propal/list.php (viewstatut parameter) or comm/propal/list.php (propal_statut parameter, aka search_statut parameter).
CVE-2017-17900CriDec 27, 2017
Dolibarr
Dolibarr
risk 0.57cvss 9.8epss 0.02
SQL injection vulnerability in fourn/index.php in Dolibarr ERP/CRM version 6.0.4 allows remote attackers to execute arbitrary SQL commands via the socid parameter.
CVE-2017-17899CriDec 27, 2017
Dolibarr
Dolibarr
risk 0.57cvss 9.8epss 0.02
SQL injection vulnerability in adherents/subscription/info.php in Dolibarr ERP/CRM version 6.0.4 allows remote attackers to execute arbitrary SQL commands via the rowid parameter.
CVE-2017-17897CriDec 27, 2017
Dolibarr
Dolibarr
risk 0.57cvss 9.8epss 0.02
SQL injection vulnerability in comm/multiprix.php in Dolibarr ERP/CRM version 6.0.4 allows remote attackers to execute arbitrary SQL commands via the id parameter.
CVE-2017-14242CriSep 11, 2017
Dolibarr
Dolibarr
risk 0.57cvss 9.8epss 0.01
SQL injection vulnerability in don/list.php in Dolibarr version 6.0.0 allows remote attackers to execute arbitrary SQL commands via the statut parameter.
CVE-2017-14238CriSep 11, 2017
Dolibarr
Dolibarr
risk 0.57cvss 9.8epss 0.01
SQL injection vulnerability in admin/menus/edit.php in Dolibarr ERP/CRM version 6.0.0 allows remote attackers to execute arbitrary SQL commands via the menuId parameter.
CVE-2017-9840HigJun 25, 2017
Dolibarr
Dolibarr
risk 0.57cvss 8.8epss 0.01
Dolibarr ERP/CRM 5.0.3 and prior allows low-privilege users to upload files of dangerous types, which can result in arbitrary code execution within the context of the vulnerable application.
CVE-2017-9435CriJun 5, 2017
Dolibarr
Dolibarr
risk 0.57cvss 9.8epss 0.01
Dolibarr ERP/CRM before 5.0.3 is vulnerable to a SQL injection in user/index.php (search_supervisor and search_statut parameters).
CVE-2020-14209HigSep 2, 2020
Dolibarr
Dolibarr
risk 0.55cvss 8.8epss 0.27
Dolibarr before 11.0.5 allows low-privilege users to upload files of dangerous types, leading to arbitrary code execution. This occurs because .pht and .phar files can be uploaded. Also, a .htaccess file can be uploaded to reconfigure access control (e.g., to let .noexe files be…

Page 2 of 8