Vulnerabilidades en Dolibarr

57 resultados
Análisis Vexday

Dolibarr apresenta 25 vulnerabilidades catalogadas, com 5 classificadas como críticas e 8 divulgadas nos últimos 90 dias, indicando descoberta contínua de falhas. Não há registros de exploração ativa em campo (KEV zero), reduzindo o risco imediato. A fraqueza dominante é injeção SQL (CWE-89), representando o vetor de ataque primário que demanda priorização em testes de segurança e patches.

CVE-2022-0174MEDIUMImproper Validation of Specified Quantity in Input in dolibarr/dolibarrEPSS 0.9%CVE-2021-25954MEDIUMImproper Access Control in “Dolibarr”EPSS 0.7%CVE-2024-5314CRITICALMultiple vulnerabilities in DOLIBARR's ERP CMSEPSS 0.6%CVE-2026-81730HIGHDolibarr 9.0.0 through 23.0.4 Path Traversal via EmailCollector Attachment FilenameEPSS 0.6%CVE-2024-23817HIGHDolibarr Application Home Page HTML injection vulnerabilityEPSS 0.6%CVE-2023-4198MEDIUMDolibarr ERP CRM (<= 17.0.3) Improper Access ControlEPSS 0.6%CVE-2026-71506HIGHDolibarr < 24.0.0 Payments REST API Improper Authorization via Delete EndpointEPSS 0.5%CVE-2026-89013HIGHDolibarr 23.0.4 < 24.0.1 Authorization Bypass via hashp Parameter in document.phpEPSS 0.5%CVE-2026-89012HIGHDolibarr 24.0.0 < 24.0.1 SQL Filter Denylist Bypass via sqlfilters ParameterEPSS 0.5%CVE-2023-5842MEDIUMCross-site Scripting (XSS) - Stored in dolibarr/dolibarrEPSS 0.5%CVE-2026-71504HIGHDolibarr < 24.0.0 Members REST API Improper Authorization via Password ResetEPSS 0.5%CVE-2026-81728HIGHDolibarr before 24.0.0 SQL Injection via the CSV and XLSX Import Update KeysEPSS 0.4%CVE-2026-71509HIGHDolibarr < 24.0.0 Expense Report REST API Improper Authorization via Update EndpointEPSS 0.4%CVE-2026-71511HIGHDolibarr < 24.0.0 Members REST API Sensitive Data Exposure via Member EndpointsEPSS 0.4%CVE-2026-71505HIGHDolibarr < 24.0.0 REST API Broken Object-Level Authorization via Third-Party Write RouteEPSS 0.4%CVE-2026-81729HIGHDolibarr before 23.0.4 Incorrect Authorization on REST API Document DeletionEPSS 0.4%CVE-2026-78160MEDIUMDolibarr ERP User Notes note.php authorizationEPSS 0.4%CVE-2026-71507HIGHDolibarr < 24.0.0 REST API Broken Object-Level Authorization via Bank Account RoutesEPSS 0.4%CVE-2026-71508HIGHDolibarr < 24.0.0 REST API Improper Authorization via User Update EndpointEPSS 0.4%CVE-2023-5323MEDIUMCross-site Scripting (XSS) - Generic in dolibarr/dolibarrEPSS 0.4%