# Dolibarr ERP CRM vulnerabilities Source: https://junglewise.ai/threats/technologies/erp-crm Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 13 November 2026, 03:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/technologies/erp-crm.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 20 vulnerabilities in Dolibarr ERP CRM: 0 in the last 7 days and 6 in the last 90 days, 1 of them critical and 0 exploited in the wild. The most recent, CVE-2026-33944, was published on 5 November 2026. 4 vulnerabilities in the last four weeks, up 300% on the four before (1). ## Counts - Last 7 days: 0 - Last 30 days: 4 - Last 90 days: 6 - All time: 20 (1 critical, 0 exploited in the wild) ## About Dolibarr ERP CRM Dolibarr ERP CRM is an open-source software suite for small and medium companies, foundations, and freelancers to manage business activities like contacts, invoices, orders, and inventory. ## Latest Dolibarr ERP CRM vulnerabilities - [CVE-2026-33944: Dolibarr SQL injection in localtax parameters](https://junglewise.ai/threats/cve-2026-33944-dolibarr-has-sql-injection-in-societe-class-societe-class-php-via) (high, CVSS 8.8, published 5 Nov 2026) - [CVE-2026-118754: Dolibarr ERP CRM missing authorization in recruitment module](https://junglewise.ai/threats/cve-2026-118754-dolibarr-erp-crm-before-24-0-2-contains-a-missing-authorization) (medium, CVSS 5.3, published 28 Oct 2026) - [CVE-2026-116219: Dolibarr ERP CRM OS command injection in export.php](https://junglewise.ai/threats/cve-2026-116219-dolibarr-erp-crm-before-24-0-0-contains-an-os-command-injection) (high, CVSS 7.2, published 26 Oct 2026) - [CVE-2026-116218: Dolibarr ERP CRM SQL injection in company bank accounts API](https://junglewise.ai/threats/cve-2026-116218-dolibarr-erp-crm-19-0-0-before-23-0-4-contains-an-sql-injection) (high, CVSS 7.6, published 26 Oct 2026) - [CVE-2026-107706: Dolibarr ERP CRM authorization bypass in extrafield update](https://junglewise.ai/threats/cve-2026-107706-dolibarr-erp-crm-before-24-0-2-contains-an-incorrect) (medium, CVSS 4.3, published 8 Oct 2026) - [CVE-2026-81031: IDURAR ERP CRM privilege escalation via password reset](https://junglewise.ai/threats/cve-2026-81031-idurar-erp-crm-privilege-escalation-via-password-reset) (high, CVSS 7.2, published 26 Aug 2026) - [CVE-2026-72600: Idurar ERP CRM broken access control in invoice download](https://junglewise.ai/threats/cve-2026-72600-idurar-erp-crm-broken-access-control-in-invoice-download) (high, CVSS 7.5, published 11 Aug 2026) - [CVE-2026-11619: Dolibarr ERP CRM improper authorization in Legacy Filemanager](https://junglewise.ai/threats/cve-2026-11619-dolibarr-erp-crm-improper-authorization-in-legacy-filemanager) (medium, CVSS 6.3, published 9 Jun 2026) - [CVE-2026-10215: Dolibarr ERP CRM improper authorization in Leave Request REST API](https://junglewise.ai/threats/cve-2026-10215-dolibarr-erp-crm-improper-authorization-in-leave-request-rest-api) (medium, CVSS 4.3, published 1 Jun 2026) - [CVE-2026-10154: Dolibarr ERP CRM authorization bypass in messaging.php](https://junglewise.ai/threats/cve-2026-10154-dolibarr-erp-crm-authorization-bypass-in-messaging-php) (medium, CVSS 4.3, published 31 May 2026) - [CVE-2026-37713: Dolibarr ERP/CRM PHP code execution in CommonObject class](https://junglewise.ai/threats/cve-2026-37713-dolibarr-erp-crm-php-code-execution-in-commonobject-class) (info, CVSS 8.1, published 27 May 2026) - [CVE-2026-37712: Dolibarr ERP/CRM remote code execution in cron scheduler](https://junglewise.ai/threats/cve-2026-37712-dolibarr-erp-crm-remote-code-execution-in-cron-scheduler) (info, CVSS 9.1, published 27 May 2026) - [CVE-2026-37711: Dolibarr ERP/CRM remote code execution in actions_addupdatedelete.inc.php](https://junglewise.ai/threats/cve-2026-37711-dolibarr-erp-crm-remote-code-execution-in-actions-addupdatedelete) (info, CVSS 9.1, published 27 May 2026) - [CVE-2018-25357: Dolibarr ERP CRM PHP code injection in install/step1.php](https://junglewise.ai/threats/cve-2018-25357-dolibarr-erp-crm-php-code-injection-in-install-step1-php) (critical, CVSS 9.8, published 23 May 2026) - [CVE-2025-67486: Dolibarr ERP/CRM remote code execution in user extrafields](https://junglewise.ai/threats/cve-2025-67486-dolibarr-erp-crm-remote-code-execution-in-user-extrafields) (high, CVSS 7.2, published 8 May 2026) - [CVE-2026-7688: Dolibarr ERP CRM SQL injection in Shipments API Endpoint](https://junglewise.ai/threats/cve-2026-7688-dolibarr-erp-crm-sql-injection-in-shipments-api-endpoint) (medium, CVSS 5, published 3 May 2026) - [CVE-2026-31019: Dolibarr ERP & CRM RCE via blacklist bypass in Website module](https://junglewise.ai/threats/cve-2026-31019-dolibarr-erp-crm-rce-via-blacklist-bypass-in-website-module) (high, CVSS 8.8, published 21 Apr 2026) - [CVE-2026-31018: Dolibarr ERP & CRM PHP code injection in Website module](https://junglewise.ai/threats/cve-2026-31018-dolibarr-erp-crm-php-code-injection-in-website-module) (high, CVSS 8.8, published 21 Apr 2026) - [CVE-2026-22666: Dolibarr ERP/CRM remote code execution in dol_eval_standard](https://junglewise.ai/threats/cve-2026-22666-dolibarr-erp-crm-remote-code-execution-in-dol-eval-standard) (high, CVSS 7.2, published 7 Apr 2026) - [CVE-2025-56588: Dolibarr ERP & CRM remote code execution in User module computed field](https://junglewise.ai/threats/cve-2025-56588-dolibarr-erp-crm-remote-code-execution-in-user-module-computed) (high, CVSS 8.8, published 1 Oct 2025) ## Most severe Dolibarr ERP CRM vulnerabilities - [CVE-2018-25357: Dolibarr ERP CRM PHP code injection in install/step1.php](https://junglewise.ai/threats/cve-2018-25357-dolibarr-erp-crm-php-code-injection-in-install-step1-php) (critical, CVSS 9.8, published 23 May 2026) - [CVE-2026-31019: Dolibarr ERP & CRM RCE via blacklist bypass in Website module](https://junglewise.ai/threats/cve-2026-31019-dolibarr-erp-crm-rce-via-blacklist-bypass-in-website-module) (high, CVSS 8.8, published 21 Apr 2026) - [CVE-2026-31018: Dolibarr ERP & CRM PHP code injection in Website module](https://junglewise.ai/threats/cve-2026-31018-dolibarr-erp-crm-php-code-injection-in-website-module) (high, CVSS 8.8, published 21 Apr 2026) - [CVE-2025-56588: Dolibarr ERP & CRM remote code execution in User module computed field](https://junglewise.ai/threats/cve-2025-56588-dolibarr-erp-crm-remote-code-execution-in-user-module-computed) (high, CVSS 8.8, published 1 Oct 2025) - [CVE-2026-33944: Dolibarr SQL injection in localtax parameters](https://junglewise.ai/threats/cve-2026-33944-dolibarr-has-sql-injection-in-societe-class-societe-class-php-via) (high, CVSS 8.8, published 5 Nov 2026) - [CVE-2026-116218: Dolibarr ERP CRM SQL injection in company bank accounts API](https://junglewise.ai/threats/cve-2026-116218-dolibarr-erp-crm-19-0-0-before-23-0-4-contains-an-sql-injection) (high, CVSS 7.6, published 26 Oct 2026) - [CVE-2026-72600: Idurar ERP CRM broken access control in invoice download](https://junglewise.ai/threats/cve-2026-72600-idurar-erp-crm-broken-access-control-in-invoice-download) (high, CVSS 7.5, published 11 Aug 2026) - [CVE-2026-22666: Dolibarr ERP/CRM remote code execution in dol_eval_standard](https://junglewise.ai/threats/cve-2026-22666-dolibarr-erp-crm-remote-code-execution-in-dol-eval-standard) (high, CVSS 7.2, published 7 Apr 2026) - [CVE-2026-81031: IDURAR ERP CRM privilege escalation via password reset](https://junglewise.ai/threats/cve-2026-81031-idurar-erp-crm-privilege-escalation-via-password-reset) (high, CVSS 7.2, published 26 Aug 2026) - [CVE-2026-116219: Dolibarr ERP CRM OS command injection in export.php](https://junglewise.ai/threats/cve-2026-116219-dolibarr-erp-crm-before-24-0-0-contains-an-os-command-injection) (high, CVSS 7.2, published 26 Oct 2026) ## Vulnerabilities per week 4 vulnerabilities in the last four weeks, up 300% on the four before (1). | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 0 | 0 | 0 | | 24 Aug 2026 | 1 | 0 | 0 | | 31 Aug 2026 | 0 | 0 | 0 | | 7 Sep 2026 | 0 | 0 | 0 | | 14 Sep 2026 | 0 | 0 | 0 | | 21 Sep 2026 | 0 | 0 | 0 | | 28 Sep 2026 | 0 | 0 | 0 | | 5 Oct 2026 | 1 | 0 | 0 | | 12 Oct 2026 | 0 | 0 | 0 | | 19 Oct 2026 | 0 | 0 | 0 | | 26 Oct 2026 | 3 | 0 | 0 | | 2 Nov 2026 | 1 | 0 | 0 | | 9 Nov 2026 | 0 | 0 | 0 | ## Other Dolibarr technologies - [Dolibarr](https://junglewise.ai/threats/technologies/dolibarr): 21 vulnerabilities - [Dolibarr Crm](https://junglewise.ai/threats/technologies/crm): 18 vulnerabilities - [Dolibarr Erp\](https://junglewise.ai/threats/technologies/dolibarr-erp): 11 vulnerabilities ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "Dolibarr ERP CRM vulnerabilities", https://junglewise.ai/threats/technologies/erp-crm, 13 November 2026.