# dolibarr/dolibarr (Packagist) vulnerabilities Source: https://junglewise.ai/threats/technologies/dolibarr-dolibarr Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 13 November 2026, 03:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/technologies/dolibarr-dolibarr.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 127 vulnerabilities in dolibarr/dolibarr (Packagist): 0 in the last 7 days and 1 in the last 90 days, 1 of them critical and 0 exploited in the wild. The most recent, CVE-2026-33944, was published on 5 November 2026. 1 vulnerability in the last four weeks, up from none in the four before. ## Counts - Last 7 days: 0 - Last 30 days: 1 - Last 90 days: 1 - All time: 127 (1 critical, 0 exploited in the wild) ## About dolibarr/dolibarr (Packagist) Open-source enterprise resource planning and customer relationship management software. ## Latest dolibarr/dolibarr (Packagist) vulnerabilities - [CVE-2026-33944: Dolibarr SQL injection in localtax parameters](https://junglewise.ai/threats/cve-2026-33944-dolibarr-has-sql-injection-in-societe-class-societe-class-php-via) (high, CVSS 8.8, published 5 Nov 2026) - [CVE-2026-10215: Dolibarr ERP CRM improper authorization in Leave Request REST API](https://junglewise.ai/threats/cve-2026-10215-dolibarr-erp-crm-improper-authorization-in-leave-request-rest-api) (medium, CVSS 4.3, published 1 Jun 2026) - [CVE-2018-25357: Dolibarr ERP CRM PHP code injection in install/step1.php](https://junglewise.ai/threats/cve-2018-25357-dolibarr-erp-crm-php-code-injection-in-install-step1-php) (critical, CVSS 9.8, published 23 May 2026) - [CVE-2026-7689: Dolibarr has Insufficient Verification of Data Authenticity](https://junglewise.ai/threats/cve-2026-7689-dolibarr-has-insufficient-verification-of-data-authenticity) (low, CVSS 3.7, published 3 May 2026) - [CVE-2026-7688: Dolibarr ERP CRM SQL injection in Shipments API Endpoint](https://junglewise.ai/threats/cve-2026-7688-dolibarr-erp-crm-sql-injection-in-shipments-api-endpoint) (medium, CVSS 5, published 3 May 2026) - [CVE-2026-31019: Dolibarr ERP & CRM RCE via blacklist bypass in Website module](https://junglewise.ai/threats/cve-2026-31019-dolibarr-erp-crm-rce-via-blacklist-bypass-in-website-module) (high, CVSS 8.8, published 21 Apr 2026) - [CVE-2026-31018: Dolibarr ERP & CRM PHP code injection in Website module](https://junglewise.ai/threats/cve-2026-31018-dolibarr-erp-crm-php-code-injection-in-website-module) (high, CVSS 8.8, published 21 Apr 2026) - [CVE-2026-23500: Dolibarr: OS Command Injection (RCE) via MAIN_ODT_AS_PDF configuration](https://junglewise.ai/threats/cve-2026-23500-dolibarr-os-command-injection-rce-via-main-odt-as-pdf) (low, CVSS 3.1, published 17 Apr 2026) - [CVE-2019-25710: Dolibarr ERP-CRM SQL injection in admin dict.php](https://junglewise.ai/threats/cve-2019-25710-dolibarr-erp-crm-sql-injection-in-admin-dict-php) (high, CVSS 8.2, published 12 Apr 2026) - [CVE-2026-34036: Dolibarr Core Discloses Sensitive Data via Authenticated Local File Inclusion in selectobject.php](https://junglewise.ai/threats/cve-2026-34036-dolibarr-core-discloses-sensitive-data-via-authenticated-local) (medium, CVSS 6.5, published 31 Mar 2026) - [CVE-2025-56588: Dolibarr ERP & CRM remote code execution in User module computed field](https://junglewise.ai/threats/cve-2025-56588-dolibarr-erp-crm-remote-code-execution-in-user-module-computed) (high, CVSS 8.8, published 1 Oct 2025) - [Dolibarr has Remote Code Execution Vulnerability (Bypass)](https://junglewise.ai/threats/dolibarr-has-remote-code-execution-vulnerability-bypass-5f5de571) (low, CVSS 3.1, published 21 Jul 2025) - [CVE-2024-55228: Dolibarr Cross-site Scripting vulnerability](https://junglewise.ai/threats/cve-2024-55228-dolibarr-cross-site-scripting-vulnerability) (low, CVSS 3.1, published 27 Jan 2025) - [CVE-2024-55227: Dolibarr Cross-site Scripting vulnerability](https://junglewise.ai/threats/cve-2024-55227-dolibarr-cross-site-scripting-vulnerability) (medium, CVSS 4, published 27 Jan 2025) - [CVE-2021-3991: Improper Authorization in dolibarr/dolibarr](https://junglewise.ai/threats/cve-2021-3991-improper-authorization-in-dolibarr-dolibarr) (low, CVSS 3, published 15 Nov 2024) - [CVE-2024-40137: Dolibarr ERP CRM vulnerable to remote code execution (RCE)](https://junglewise.ai/threats/cve-2024-40137-dolibarr-erp-crm-vulnerable-to-remote-code-execution-rce) (low, CVSS 3.1, published 24 Jul 2024) - [CVE-2024-37821: Dolibarr arbitrary file upload vulnerability](https://junglewise.ai/threats/cve-2024-37821-dolibarr-arbitrary-file-upload-vulnerability) (low, CVSS 3.1, published 18 Jun 2024) - [CVE-2024-34051: Reflected Cross-Site Scripting (XSS) in Dolibarr](https://junglewise.ai/threats/cve-2024-34051-reflected-cross-site-scripting-xss-in-dolibarr) (info, published 3 Jun 2024) - [CVE-2024-5315: Dolibarr vulnerable to SQL Injection](https://junglewise.ai/threats/cve-2024-5315-dolibarr-vulnerable-to-sql-injection) (low, CVSS 3.1, published 24 May 2024) - [CVE-2024-5314: Dolibarr vulnerable to SQL Injection](https://junglewise.ai/threats/cve-2024-5314-dolibarr-vulnerable-to-sql-injection) (low, CVSS 3.1, published 24 May 2024) - [CVE-2024-23817: Dolibarr Application Home Page has HTML injection vulnerability](https://junglewise.ai/threats/cve-2024-23817-dolibarr-application-home-page-has-html-injection-vulnerability) (low, CVSS 3.1, published 18 Apr 2024) - [CVE-2024-31503: Dolibarr vulnerable to Cross-Site Request Forgery](https://junglewise.ai/threats/cve-2024-31503-dolibarr-vulnerable-to-cross-site-request-forgery) (low, CVSS 3.1, published 17 Apr 2024) - [CVE-2024-29477: Dolibarr ERP CRM Code Injection vulnerability during installation](https://junglewise.ai/threats/cve-2024-29477-dolibarr-erp-crm-code-injection-vulnerability-during-installation) (low, CVSS 3.1, published 3 Apr 2024) - [CVE-2023-4198: Dolibarr Improper Input Validation vulnerability](https://junglewise.ai/threats/cve-2023-4198-dolibarr-improper-input-validation-vulnerability) (low, CVSS 3.1, published 1 Nov 2023) - [CVE-2023-4197: Dolibarr Improper Input Validation vulnerability](https://junglewise.ai/threats/cve-2023-4197-dolibarr-improper-input-validation-vulnerability) (low, CVSS 3.1, published 1 Nov 2023) ## Most severe dolibarr/dolibarr (Packagist) vulnerabilities - [CVE-2018-25357: Dolibarr ERP CRM PHP code injection in install/step1.php](https://junglewise.ai/threats/cve-2018-25357-dolibarr-erp-crm-php-code-injection-in-install-step1-php) (critical, CVSS 9.8, published 23 May 2026) - [CVE-2026-31019: Dolibarr ERP & CRM RCE via blacklist bypass in Website module](https://junglewise.ai/threats/cve-2026-31019-dolibarr-erp-crm-rce-via-blacklist-bypass-in-website-module) (high, CVSS 8.8, published 21 Apr 2026) - [CVE-2026-31018: Dolibarr ERP & CRM PHP code injection in Website module](https://junglewise.ai/threats/cve-2026-31018-dolibarr-erp-crm-php-code-injection-in-website-module) (high, CVSS 8.8, published 21 Apr 2026) - [CVE-2025-56588: Dolibarr ERP & CRM remote code execution in User module computed field](https://junglewise.ai/threats/cve-2025-56588-dolibarr-erp-crm-remote-code-execution-in-user-module-computed) (high, CVSS 8.8, published 1 Oct 2025) - [CVE-2026-33944: Dolibarr SQL injection in localtax parameters](https://junglewise.ai/threats/cve-2026-33944-dolibarr-has-sql-injection-in-societe-class-societe-class-php-via) (high, CVSS 8.8, published 5 Nov 2026) - [CVE-2019-25710: Dolibarr ERP-CRM SQL injection in admin dict.php](https://junglewise.ai/threats/cve-2019-25710-dolibarr-erp-crm-sql-injection-in-admin-dict-php) (high, CVSS 8.2, published 12 Apr 2026) - [CVE-2026-34036: Dolibarr Core Discloses Sensitive Data via Authenticated Local File Inclusion in selectobject.php](https://junglewise.ai/threats/cve-2026-34036-dolibarr-core-discloses-sensitive-data-via-authenticated-local) (medium, CVSS 6.5, published 31 Mar 2026) - [CVE-2026-7688: Dolibarr ERP CRM SQL injection in Shipments API Endpoint](https://junglewise.ai/threats/cve-2026-7688-dolibarr-erp-crm-sql-injection-in-shipments-api-endpoint) (medium, CVSS 5, published 3 May 2026) - [CVE-2026-10215: Dolibarr ERP CRM improper authorization in Leave Request REST API](https://junglewise.ai/threats/cve-2026-10215-dolibarr-erp-crm-improper-authorization-in-leave-request-rest-api) (medium, CVSS 4.3, published 1 Jun 2026) - [CVE-2024-55227: Dolibarr Cross-site Scripting vulnerability](https://junglewise.ai/threats/cve-2024-55227-dolibarr-cross-site-scripting-vulnerability) (medium, CVSS 4, published 27 Jan 2025) ## Vulnerabilities per week 1 vulnerability in the last four weeks, up from none in the four before. | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 0 | 0 | 0 | | 24 Aug 2026 | 0 | 0 | 0 | | 31 Aug 2026 | 0 | 0 | 0 | | 7 Sep 2026 | 0 | 0 | 0 | | 14 Sep 2026 | 0 | 0 | 0 | | 21 Sep 2026 | 0 | 0 | 0 | | 28 Sep 2026 | 0 | 0 | 0 | | 5 Oct 2026 | 0 | 0 | 0 | | 12 Oct 2026 | 0 | 0 | 0 | | 19 Oct 2026 | 0 | 0 | 0 | | 26 Oct 2026 | 0 | 0 | 0 | | 2 Nov 2026 | 1 | 0 | 0 | | 9 Nov 2026 | 0 | 0 | 0 | ## Other Packagist technologies - [moodle/moodle (Packagist)](https://junglewise.ai/threats/technologies/moodle-moodle): 434 vulnerabilities - [magento/community-edition (Packagist)](https://junglewise.ai/threats/technologies/packagist-magento-community-edition): 362 vulnerabilities - [typo3/cms (Packagist)](https://junglewise.ai/threats/technologies/packagist-typo3-cms): 187 vulnerabilities - [wwbn/avideo (Packagist)](https://junglewise.ai/threats/technologies/wwbn-avideo): 164 vulnerabilities - [magento/project-community-edition (Packagist)](https://junglewise.ai/threats/technologies/magento-project-community-edition): 161 vulnerabilities - [drupal/core (Packagist)](https://junglewise.ai/threats/technologies/packagist-drupal-core): 150 vulnerabilities - [pimcore/pimcore (Packagist)](https://junglewise.ai/threats/technologies/pimcore-pimcore): 145 vulnerabilities - [craftcms/cms (Packagist)](https://junglewise.ai/threats/technologies/craftcms-cms): 143 vulnerabilities - [getgrav/grav (Packagist)](https://junglewise.ai/threats/technologies/getgrav-grav): 127 vulnerabilities - [typo3/cms-core (Packagist)](https://junglewise.ai/threats/technologies/typo3-cms-core): 127 vulnerabilities - [concrete5/concrete5 (Packagist)](https://junglewise.ai/threats/technologies/concrete5-concrete5): 122 vulnerabilities - [thorsten/phpmyfaq (Packagist)](https://junglewise.ai/threats/technologies/thorsten-phpmyfaq): 119 vulnerabilities ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "dolibarr/dolibarr (Packagist) vulnerabilities", https://junglewise.ai/threats/technologies/dolibarr-dolibarr, 13 November 2026.