Vulnerabilities in dolibarr
63 resultsCVE-2026-78160MEDIUMDolibarr ERP User Notes note.php authorizationEPSS 0.4%CVE-2026-81729HIGHDolibarr before 23.0.4 Incorrect Authorization on REST API Document DeletionEPSS 0.4%CVE-2026-71507HIGHDolibarr < 24.0.0 REST API Broken Object-Level Authorization via Bank Account RoutesEPSS 0.4%CVE-2026-71508HIGHDolibarr < 24.0.0 REST API Improper Authorization via User Update EndpointEPSS 0.4%CVE-2026-71510HIGHDolibarr < 24.0.0 Users REST API SQL Injection via filter parameterEPSS 0.4%CVE-2026-71503MEDIUMDolibarr < 24.0.0 Reflected XSS via Extra Fields Administration TemplateEPSS 0.4%CVE-2026-77923MEDIUMDolibarr 21.0.0 < 24.0.0 Authorization Bypass via clonetasks Mass ActionEPSS 0.4%CVE-2026-58376HIGHDolibarr - SQL Injection via sqlfilters Parameter in Multiple REST API List EndpointsEPSS 0.4%CVE-2019-25450HIGHDolibarr ERP/CRM 10.0.1 SQL Injection via card.phpEPSS 0.4%CVE-2021-47779HIGHDolibarr ERP-CRM 14.0.2 - Stored Cross-Site Scripting (XSS) / Privilege EscalationEPSS 0.4%CVE-2026-82633MEDIUMDolibarr 10.0.0 before 24.0.0 Missing Authorization on REST Users Groups EndpointEPSS 0.3%CVE-2021-3991MEDIUMImproper Authorization in dolibarr/dolibarrEPSS 0.3%CVE-2019-25710HIGHDolibarr ERP-CRM 8.0.4 SQL Injection via rowid ParameterEPSS 0.3%CVE-2020-36966MEDIUMDolibarr 11.0.3 - 'ldap.php' - Persistent Cross-Site ScriptingEPSS 0.3%CVE-2026-116218HIGHDolibarr ERP CRM 19.0.0 before 23.0.4 SQL Injection via bankaccounts API type fieldEPSS 0.3%CVE-2026-10215MEDIUMDolibarr ERP CRM Leave Request REST API api_holidays.class.php checkUserAccessToObject improper authorizationEPSS 0.3%CVE-2026-19350MEDIUMDolibarr ERP TakePOS invoice.php fail authorizationEPSS 0.3%CVE-2026-118754MEDIUMDolibarr ERP CRM before 24.0.2 Missing Authorization via public recruitment view.phpEPSS 0.2%CVE-2026-10154MEDIUMDolibarr ERP CRM messaging.php authorizationEPSS 0.2%CVE-2026-7688LOWDolibarr ERP CRM Shipments API Endpoint expedition.class.php _checkValForAPI sql injectionEPSS 0.2%