Dolibarr: >> Dolibarr Erp/crm >> 16.0.0 Security Vulnerabilities
An Improper Authorization vulnerability exists in Dolibarr versions prior to the 'develop' branch. A user with restricted permissions in the 'Reception' section is able to access specific reception details via direct URL access, bypassing the intended permission restrictions.
CVSS Score
4.3
EPSS Score
0.001
Published
2024-11-15
An arbitrary file upload vulnerability in the Upload Template function of Dolibarr ERP CRM up to v19.0.1 allows attackers to execute arbitrary code via uploading a crafted .SQL file.
CVSS Score
8.8
EPSS Score
0.001
Published
2024-06-18
Incorrect access control in Dolibarr ERP CRM versions 19.0.0 and before, allows authenticated attackers to steal victim users' session cookies and CSRF protection tokens via user interaction with a crafted web page, leading to account takeover.
CVSS Score
7.5
EPSS Score
0.0
Published
2024-04-17
Lack of sanitization during Installation Process in Dolibarr ERP CRM up to version 19.0.0 allows an attacker with adjacent access to the network to execute arbitrary code via a specifically crafted input.
CVSS Score
8.8
EPSS Score
0.001
Published
2024-04-03
Improper Access Control in Dolibarr ERP CRM <= v17.0.3 allows an unauthorized authenticated user to read a database table containing customer data
CVSS Score
6.5
EPSS Score
0.001
Published
2023-11-01
Improper input validation in Dolibarr ERP CRM <= v18.0.1 fails to strip certain PHP code from user-supplied input when creating a Website, allowing an attacker to inject and evaluate arbitrary PHP code.
CVSS Score
7.5
EPSS Score
0.327
Published
2023-11-01
Cross-site Scripting (XSS) - Stored in GitHub repository dolibarr/dolibarr prior to 16.0.5.
CVSS Score
4.8
EPSS Score
0.001
Published
2023-10-30
Cross-site Scripting (XSS) - Generic in GitHub repository dolibarr/dolibarr prior to 18.0.
CVSS Score
5.4
EPSS Score
0.002
Published
2023-10-01
An issue in Dolibarr ERP CRM v.17.0.1 and before allows a remote privileged attacker to execute arbitrary code via a crafted command/script.
CVSS Score
7.2
EPSS Score
0.485
Published
2023-09-20
File Upload vulnerability in Dolibarr ERP CRM v.17.0.1 and before allows a remote attacker to execute arbitrary code and obtain sensitive information via the extension filtering and renaming functions.
CVSS Score
8.8
EPSS Score
0.03
Published
2023-09-20
Page 1