Dolibarr
Don't miss out!
Thousands of developers use stack.watch to stay informed.Get an email whenever new security vulnerabilities are reported in any Dolibarr product.
RSS Feeds for Dolibarr security vulnerabilities
Create a CVE RSS feed including security vulnerabilities found in Dolibarr products with stack.watch. Just hit watch, then grab your custom RSS feed url.
Products by Dolibarr Sorted by Most Security Vulnerabilities since 2018
By the Year
In 2025 there have been 2 vulnerabilities in Dolibarr with an average score of 9.0 out of ten. Last year, in 2024 Dolibarr had 7 security vulnerabilities published. Right now, Dolibarr is on track to have less security vulnerabilities in 2025 than it did last year. However, the average CVE base score of the vulnerabilities in 2025 is greater by 1.52.
| Year | Vulnerabilities | Average Score |
|---|---|---|
| 2025 | 2 | 9.00 |
| 2024 | 7 | 7.48 |
| 2023 | 9 | 7.57 |
| 2022 | 14 | 7.19 |
| 2021 | 7 | 7.23 |
| 2020 | 20 | 6.91 |
| 2019 | 26 | 6.79 |
| 2018 | 10 | 8.44 |
It may take a day or so for new Dolibarr vulnerabilities to show up in the stats or in the list of recent security vulnerabilties. Additionally vulnerabilities may be tagged under a different product or component name.
Recent Dolibarr Security Vulnerabilities
A cross-site scripting (XSS) vulnerability in the Product module of Dolibarr v21.0.0-beta
CVE-2024-55228
9 - Critical
- January 27, 2025
A cross-site scripting (XSS) vulnerability in the Product module of Dolibarr v21.0.0-beta allows attackers to execute arbitrary web scripts or HTMl via a crafted payload injected into the Title parameter.
XSS
A cross-site scripting (XSS) vulnerability in the Events/Agenda module of Dolibarr v21.0.0-beta
CVE-2024-55227
9 - Critical
- January 27, 2025
A cross-site scripting (XSS) vulnerability in the Events/Agenda module of Dolibarr v21.0.0-beta allows attackers to execute arbitrary web scripts or HTMl via a crafted payload injected into the Title parameter.
XSS
An Improper Authorization vulnerability exists in Dolibarr versions prior to the 'develop' branch
CVE-2021-3991
4.3 - Medium
- November 15, 2024
An Improper Authorization vulnerability exists in Dolibarr versions prior to the 'develop' branch. A user with restricted permissions in the 'Reception' section is able to access specific reception details via direct URL access, bypassing the intended permission restrictions.
Insecure Direct Object Reference / IDOR
An arbitrary file upload vulnerability in the Upload Template function of Dolibarr ERP CRM up to v19.0.1
CVE-2024-37821
- June 18, 2024
An arbitrary file upload vulnerability in the Upload Template function of Dolibarr ERP CRM up to v19.0.1 allows attackers to execute arbitrary code via uploading a crafted .SQL file.
Vulnerabilities in Dolibarr ERP - CRM that affect version 9.0.1 and allow SQL injection
CVE-2024-5314
9.1 - Critical
- May 24, 2024
Vulnerabilities in Dolibarr ERP - CRM that affect version 9.0.1 and allow SQL injection. These vulnerabilities could allow a remote attacker to send a specially crafted SQL query to the system and retrieve all the information stored in the database through the parameters sortorder y sortfield in /dolibarr/admin/dict.php.
SQL Injection
Vulnerabilities in Dolibarr ERP - CRM that affect version 9.0.1 and allow SQL injection
CVE-2024-5315
9.1 - Critical
- May 24, 2024
Vulnerabilities in Dolibarr ERP - CRM that affect version 9.0.1 and allow SQL injection. These vulnerabilities could allow a remote attacker to send a specially crafted SQL query to the system and retrieve all the information stored in the database through the parameters viewstatut in /dolibarr/commande/list.php.
SQL Injection
Incorrect access control in Dolibarr ERP CRM versions 19.0.0 and before
CVE-2024-31503
- April 17, 2024
Incorrect access control in Dolibarr ERP CRM versions 19.0.0 and before, allows authenticated attackers to steal victim users' session cookies and CSRF protection tokens via user interaction with a crafted web page, leading to account takeover.
Session Riding
Lack of sanitization during Installation Process in Dolibarr ERP CRM up to version 19.0.0
CVE-2024-29477
8.8 - High
- April 03, 2024
Lack of sanitization during Installation Process in Dolibarr ERP CRM up to version 19.0.0 allows an attacker with adjacent access to the network to execute arbitrary code via a specifically crafted input.
Code Injection
Dolibarr is an enterprise resource planning (ERP) and customer relationship management (CRM) software package
CVE-2024-23817
6.1 - Medium
- January 25, 2024
Dolibarr is an enterprise resource planning (ERP) and customer relationship management (CRM) software package. Version 18.0.4 has a HTML Injection vulnerability in the Home page of the Dolibarr Application. This vulnerability allows an attacker to inject arbitrary HTML tags and manipulate the rendered content in the application's response. Specifically, I was able to successfully inject a new HTML tag into the returned document and, as a result, was able to comment out some part of the Dolibarr App Home page HTML code. This behavior can be exploited to perform various attacks like Cross-Site Scripting (XSS). To remediate the issue, validate and sanitize all user-supplied input, especially within HTML attributes, to prevent HTML injection attacks; and implement proper output encoding when rendering user-provided data to ensure it is treated as plain text rather than executable HTML.
XSS
Improper Access Control in Dolibarr ERP CRM <= v17.0.3
CVE-2023-4198
6.5 - Medium
- November 01, 2023
Improper Access Control in Dolibarr ERP CRM <= v17.0.3 allows an unauthorized authenticated user to read a database table containing customer data
AuthZ