CVE-2026-33944highCWE-89

CVE-2026-33944: falha de alta gravidade em dolibarr

Dolibarr: SQL Injection in societe/class/societe.class.php via localtax1_value parameter

Publicada em

Seguir esta CVE+ Monitorar dolibarr+ Monitorar dolibarr/dolibarr

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

21Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 8.8epss 0.5%
Dolibarr is an open-source enterprise resource planning and customer relationship management application. Prior to 22.0.5 and 23.0.1, there is a SQL injection vulnerability in the Third Party company update functionality. The application concatenates the  localtax1_value  and  localtax2_value  properties into an SQL UPDATE statement without numeric conversion or other appropriate sanitization. An authenticated user with Third Party create or edit permission can submit crafted  lt1  or  lt2  POST parameters to read sensitive database information, including password hashes, API keys, and business data, or modify third-party records. This issue is fixed in versions 22.0.5 and 23.0.2.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Produtos afetados
Dolibarr · dolibarr
CVEs relacionadas — dolibarr

No mesmo produto, das mais perigosas para as menos.

CVE-2026-116219HIGHDolibarr ERP CRM before 24.0.0 OS Command Injection via mysqldump ParameterEPSS 2.1%CVE-2026-34036MEDIUMDolibarr Core Discloses Sensitive Data via Authenticated Local File Inclusion in selectobject.phpEPSS 1.5%CVE-2021-25957HIGHAccount Takeover in "Dolibarr" via Password Reset FunctionalityEPSS 1.1%CVE-2021-25956MEDIUMImproper User Access Control in "Dolibarr" Leads to Account TakeoverEPSS 0.9%CVE-2026-23500CRITICALDolibarr: OS Command Injection (RCE) via MAIN_ODT_AS_PDF configurationEPSS 0.9%CVE-2021-25955CRITICALStored XSS in “Dolibarr” leads to privilege escalationEPSS 0.9%