Known vulnerabilities in dolibarr

Software: dolibarr
Software CPE: cpe:2.3:a:dolibarr_erp_and_crm:dolibarr:*:*:*:*:*:*:*:*
Total vulnerabilities: 81
Public exploits: 11
Known exploited (KEV): 0
Highest CVSSv4 Score: 9.3

Breakdown by Severity Chart

Severity distribution of vulnerabilities affecting dolibarr dolibarr is affected by 81 known vulnerabilities: 21 high, 12 medium, 48 low Critical High Medium Low

Vulnerabilities (81)

Vulnerability CWE-ID CSH Severity Public Exploit KEV First fixed release Published Bulletins
#VU126579 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
CVE-2026-23500
CWE-78 Low
No
No
23.0.0 20.04.2026 SB20260420106
#VU126578 - Improper Control of Filename for Include/Require Statement in PHP Program
CVE-2026-34036
CWE-98 Low
No
No
23.0.0 20.04.2026 SB20260420106
#VU63990 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2021-33618
CWE-79 Low
No
No
13.0.3 06.06.2022 SB2021111141
#VU61025 - Improper Control of Generation of Code ('Code Injection')
CVE-2022-0819
CWE-94 Low
No
No
15.0.1 04.03.2022 SB2022030414
#VU49984 - Permissions, Privileges, and Access Controls
CWE-264 Medium
No
No
13.0.0 25.01.2021 SB2021012526
#VU49178 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
CVE-2020-35136
CWE-78 Medium
No
No
12.0.4 23.12.2020 SB2020122904
#VU46583 - Unrestricted Upload of File with Dangerous Type
CVE-2020-14209
CWE-434 High
Available
No
11.0.5 02.09.2020 SB2020082110
#VU46546 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2020-13828
CWE-79 Low
No
No
11.0.5 31.08.2020 SB2020082110
#VU46081 - Improper Privilege Management
CVE-2020-14201
CWE-269 Medium
No
No
11.0.5 21.08.2020 SB2020082110
#VU29227 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2020-14475
CWE-79 Low
No
No
12.0.0 24.06.2020 SB2020062407
#VU29226 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CVE-2020-14443
CWE-89 Medium
No
No
12.0.0 24.06.2020 SB2020062407
#VU28306 - Unrestricted Upload of File with Dangerous Type
CVE-2020-13240
CWE-434 Medium
No
No
11.0.5 28.05.2020 SB2020052804
#VU28305 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2020-13239
CWE-79 Low
No
No
11.0.5 28.05.2020 SB2020052804
#VU28007 - Improper Authorization
CVE-2020-12669
CWE-285 High
No
No
11.0.4 19.05.2020 SB2020051912
#VU28006 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2020-13094
CWE-79 Low
Available
No
11.0.4 19.05.2020 SB2020051912
#VU26310 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CVE-2019-19212
CWE-89 High
No
No
10.0.3 23.03.2020 SB2020032305
#VU26309 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2019-19211
CWE-79 Low
No
No
10.0.3 23.03.2020 SB2020032305
#VU26308 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2019-19210
CWE-79 Low
No
No
10.0.3 23.03.2020 SB2020032305
#VU26307 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2019-19209
CWE-79 Low
No
No
10.0.3 23.03.2020 SB2020032305
#VU26306 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CVE-2019-19209
CWE-89 High
No
No
10.0.3 23.03.2020 SB2020032305


Showing elements 1 - 20 out of 81