CloudMap 漏洞情报库

高危CVE-2026-890132026/09/30

Dolibarr < 24.0.0 - Authorization Bypass via hashp Parameter

Dolibarr ERP/CRM versions 23.0.4 through 24.0.0 contain an authorization bypass vulnerability in document.php and viewimage.php. The public share-link feature forces NOLOGIN when hashp is present, but the value 'shared' skips token resolution while the override still fires for any non-empty hashp value. This bypass allows unauthenticated remote attackers to read arbitrary files from all Dolibarr managed directories including logs, SQL database backups, invoices, contracts, user vcards, and custom module sources.

DolibarrPoC 已收录

CVSS—

中危CVE-2026-340362026/09/30

Dolibarr <=22.0.4 - Local File Inclusion

Dolibarr <= 22.0.4 contains a local file inclusion caused by manipulation of the objectdesc parameter and a fail-open logic flaw in restrictedArea() in /core/ajax/selectobject.php, letting authenticated users with no specific privileges read arbitrary non-PHP files.

DolibarrPoC 已收录

CVSS—

严重CVE-2024-53152024/05/24

Dolibarr ERP CMS `list.php` - SQL Injection

Vulnerabilities in Dolibarr ERP - CRM that affect version 9.0.1 and allow SQL injection.

DolibarrPoC 已收录

CVSS9.1EPSS 43.0%

高危2023/12/21

Dolibarr Installer

Dolibarr is susceptible to the Installation page exposure due to misconfiguration.

DolibarrPoC 已收录

CVSS—

高危CVE-2023-335682023/06/13

Dolibarr Unauthenticated Contacts Database Theft

An issue in Dolibarr 16 before 16.0.5 allows unauthenticated attackers to perform a database dump and access a company's entire customer file, prospects, suppliers, and employee information if a contact file exists.

DolibarrPoC 已收录

CVSS7.5EPSS 72.6%

严重CVE-2022-408712022/10/12

CVE-2022-40871

Dolibarr ERP & CRM <=15.0.3 is vulnerable to Eval injection. By default, any administrator can be added to the installation page of dolibarr, and if successfully added, malicious code can be inserted into the database and then execute it by eval.

DolibarrPoC 已收录EXP 已收录RCE

CVSS9.8EPSS 78.7%

严重CVE-2018-100942018/05/22

CVE-2018-10094

SQL injection vulnerability in Dolibarr before 7.0.2 allows remote attackers to execute arbitrary SQL commands via vectors involving integer parameters without quotes.

DolibarrRCE

CVSS9.8EPSS 74.4%

中危CVE-2018-100952018/05/22

Dolibarr <7.0.2 - Cross-Site Scripting

Dolibarr before 7.0.2 is vulnerable to cross-site scripting and allows remote attackers to inject arbitrary web script or HTML via the foruserlogin parameter to adherents/cartes/carte.php.

DolibarrPoC 已收录

CVSS6.1EPSS 58.1%

高危CVE-2012-12262012/02/21

Dolibarr ERP/CRM 3.2 Alpha - Multiple Directory Traversal Vulnerabilities

Multiple directory traversal vulnerabilities in Dolibarr CMS 3.2.0 Alpha allow remote attackers to read arbitrary files and possibly execute arbitrary code via a .. (dot dot) in the (1) file parameter to document.php or (2) backtopage parameter in a create action to comm/action/fiche.php.

DolibarrPoC 已收录

CVSS7.5EPSS 10.3%

Dolibarr

关联漏洞