# CVE-2019-25710: Dolibarr ERP-CRM SQL injection in admin dict.php

Source: https://junglewise.ai/threats/cve-2019-25710-dolibarr-erp-crm-sql-injection-in-admin-dict-php  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-04-12. Updated: 2026-05-11  
License: CC BY 4.0 with a link back

CVE-2019-25710 · Severity: high · CVSS 8.2 · Published 2026-04-12

Dolibarr ERP-CRM 8.0.4 contains an SQL injection vulnerability in the rowid parameter of the admin dict.php endpoint that allows attackers to execute arbitrary SQL queries.

Technologies: [Dolibarr Crm](https://junglewise.ai/threats/technologies/crm), [Dolibarr Erp\](https://junglewise.ai/threats/technologies/dolibarr-erp), [dolibarr/dolibarr (Packagist)](https://junglewise.ai/threats/technologies/dolibarr-dolibarr). Vendors: [Dolibarr](https://junglewise.ai/threats/vendors/dolibarr), [Packagist](https://junglewise.ai/threats/vendors/packagist).

## Quick answers

**Is CVE-2019-25710 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2019-25710 being exploited in the wild.

**How severe is CVE-2019-25710?** High severity, with a CVSS score of 8.2, published 12 April 2026.

**Which products and versions are affected?** dolibarr/dolibarr (Packagist) <= 8.0.4, ECOSYSTEM:introduced=0,last_affected=8.0.4.

**Is there a fix for CVE-2019-25710?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**Am I affected by CVE-2019-25710?** Check whether you run Dolibarr Crm, Dolibarr Erp\ or dolibarr/dolibarr (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Affected products

- Dolibarr Crm
- Dolibarr Erp\
- dolibarr/dolibarr (Packagist) <= 8.0.4, ECOSYSTEM:introduced=0,last_affected=8.0.4

## Identifiers

- CVE-2019-25710
- GHSA-xxxg-x793-7fq3

## References

- [https://sourceforge.net/projects/dolibarr/files/Dolibarr%20ERP-CRM/8.0.4/dolibarr-8.0.4.zip](https://sourceforge.net/projects/dolibarr/files/Dolibarr%20ERP-CRM/8.0.4/dolibarr-8.0.4.zip)
- [https://www.dolibarr.org/](https://www.dolibarr.org/)
- [https://www.exploit-db.com/exploits/46095](https://www.exploit-db.com/exploits/46095)
- [https://www.vulncheck.com/advisories/dolibarr-erp-crm-sql-injection-via-rowid-parameter](https://www.vulncheck.com/advisories/dolibarr-erp-crm-sql-injection-via-rowid-parameter)

## Related threats

- [Dolibarr SQL injection in localtax parameters](https://junglewise.ai/threats/cve-2026-33944-dolibarr-has-sql-injection-in-societe-class-societe-class-php-via)
- [Dolibarr path traversal in email attachment handling](https://junglewise.ai/threats/cve-2026-81730-dolibarr-path-traversal-in-email-attachment-handling)
- [Dolibarr REST API authorization bypass in document deletion](https://junglewise.ai/threats/cve-2026-81729-dolibarr-rest-api-authorization-bypass-in-document-deletion)
- [Dolibarr SQL injection in CSV/XLSX import wizard](https://junglewise.ai/threats/cve-2026-81728-dolibarr-sql-injection-in-csv-xlsx-import-wizard)
- [Dolibarr authorization bypass in clonetasks private project check](https://junglewise.ai/threats/cve-2026-77923-dolibarr-authorization-bypass-in-clonetasks-private-project-check)