Dolibarr Dolibarr

Don't miss out!

Thousands of developers use stack.watch to stay informed.
Get an email whenever new security vulnerabilities are reported in any Dolibarr product.

RSS Feeds for Dolibarr security vulnerabilities

Create a CVE RSS feed including security vulnerabilities found in Dolibarr products with stack.watch. Just hit watch, then grab your custom RSS feed url.

Products by Dolibarr Sorted by Most Security Vulnerabilities since 2018

Dolibarr Erpcrm91 vulnerabilities

Dolibarr61 vulnerabilities

By the Year

In 2025 there have been 2 vulnerabilities in Dolibarr with an average score of 9.0 out of ten. Last year, in 2024 Dolibarr had 7 security vulnerabilities published. Right now, Dolibarr is on track to have less security vulnerabilities in 2025 than it did last year. However, the average CVE base score of the vulnerabilities in 2025 is greater by 1.52.




Year Vulnerabilities Average Score
2025 2 9.00
2024 7 7.48
2023 9 7.57
2022 14 7.19
2021 7 7.23
2020 20 6.91
2019 26 6.79
2018 10 8.44

It may take a day or so for new Dolibarr vulnerabilities to show up in the stats or in the list of recent security vulnerabilties. Additionally vulnerabilities may be tagged under a different product or component name.

Recent Dolibarr Security Vulnerabilities

A cross-site scripting (XSS) vulnerability in the Product module of Dolibarr v21.0.0-beta

CVE-2024-55228 9 - Critical - January 27, 2025

A cross-site scripting (XSS) vulnerability in the Product module of Dolibarr v21.0.0-beta allows attackers to execute arbitrary web scripts or HTMl via a crafted payload injected into the Title parameter.

XSS

A cross-site scripting (XSS) vulnerability in the Events/Agenda module of Dolibarr v21.0.0-beta

CVE-2024-55227 9 - Critical - January 27, 2025

A cross-site scripting (XSS) vulnerability in the Events/Agenda module of Dolibarr v21.0.0-beta allows attackers to execute arbitrary web scripts or HTMl via a crafted payload injected into the Title parameter.

XSS

An Improper Authorization vulnerability exists in Dolibarr versions prior to the 'develop' branch

CVE-2021-3991 4.3 - Medium - November 15, 2024

An Improper Authorization vulnerability exists in Dolibarr versions prior to the 'develop' branch. A user with restricted permissions in the 'Reception' section is able to access specific reception details via direct URL access, bypassing the intended permission restrictions.

Insecure Direct Object Reference / IDOR

An arbitrary file upload vulnerability in the Upload Template function of Dolibarr ERP CRM up to v19.0.1

CVE-2024-37821 - June 18, 2024

An arbitrary file upload vulnerability in the Upload Template function of Dolibarr ERP CRM up to v19.0.1 allows attackers to execute arbitrary code via uploading a crafted .SQL file.

Vulnerabilities in Dolibarr ERP - CRM that affect version 9.0.1 and allow SQL injection

CVE-2024-5314 9.1 - Critical - May 24, 2024

Vulnerabilities in Dolibarr ERP - CRM that affect version 9.0.1 and allow SQL injection. These vulnerabilities could allow a remote attacker to send a specially crafted SQL query to the system and retrieve all the information stored in the database through the parameters sortorder y sortfield in /dolibarr/admin/dict.php.

SQL Injection

Vulnerabilities in Dolibarr ERP - CRM that affect version 9.0.1 and allow SQL injection

CVE-2024-5315 9.1 - Critical - May 24, 2024

Vulnerabilities in Dolibarr ERP - CRM that affect version 9.0.1 and allow SQL injection. These vulnerabilities could allow a remote attacker to send a specially crafted SQL query to the system and retrieve all the information stored in the database through the parameters viewstatut in /dolibarr/commande/list.php.

SQL Injection

Incorrect access control in Dolibarr ERP CRM versions 19.0.0 and before

CVE-2024-31503 - April 17, 2024

Incorrect access control in Dolibarr ERP CRM versions 19.0.0 and before, allows authenticated attackers to steal victim users' session cookies and CSRF protection tokens via user interaction with a crafted web page, leading to account takeover.

Session Riding

Lack of sanitization during Installation Process in Dolibarr ERP CRM up to version 19.0.0

CVE-2024-29477 8.8 - High - April 03, 2024

Lack of sanitization during Installation Process in Dolibarr ERP CRM up to version 19.0.0 allows an attacker with adjacent access to the network to execute arbitrary code via a specifically crafted input.

Code Injection

Dolibarr is an enterprise resource planning (ERP) and customer relationship management (CRM) software package

CVE-2024-23817 6.1 - Medium - January 25, 2024

Dolibarr is an enterprise resource planning (ERP) and customer relationship management (CRM) software package. Version 18.0.4 has a HTML Injection vulnerability in the Home page of the Dolibarr Application. This vulnerability allows an attacker to inject arbitrary HTML tags and manipulate the rendered content in the application's response. Specifically, I was able to successfully inject a new HTML tag into the returned document and, as a result, was able to comment out some part of the Dolibarr App Home page HTML code. This behavior can be exploited to perform various attacks like Cross-Site Scripting (XSS). To remediate the issue, validate and sanitize all user-supplied input, especially within HTML attributes, to prevent HTML injection attacks; and implement proper output encoding when rendering user-provided data to ensure it is treated as plain text rather than executable HTML.

XSS

Improper Access Control in Dolibarr ERP CRM <= v17.0.3

CVE-2023-4198 6.5 - Medium - November 01, 2023

Improper Access Control in Dolibarr ERP CRM <= v17.0.3 allows an unauthorized authenticated user to read a database table containing customer data

AuthZ

Built by Foundeo Inc., with data from the National Vulnerability Database (NVD). Privacy Policy. Use of this site is governed by the Legal Terms
Disclaimer
CONTENT ON THIS WEBSITE IS PROVIDED ON AN "AS IS" BASIS AND DOES NOT IMPLY ANY KIND OF GUARANTEE OR WARRANTY, INCLUDING THE WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR USE. YOUR USE OF THE INFORMATION ON THE DOCUMENT OR MATERIALS LINKED FROM THE DOCUMENT IS AT YOUR OWN RISK. Always check with your vendor for the most up to date, and accurate information.