Vulnerabilities > Dolibarr > Dolibarr ERP CRM > 3.5.8

DATE CVE VULNERABILITY TITLE RISK
2022-11-17 CVE-2022-43138 Unspecified vulnerability in Dolibarr Erp/Crm
Dolibarr Open Source ERP & CRM for Business before v14.0.1 allows attackers to escalate privileges via a crafted API.
network
low complexity
dolibarr
critical
9.8
2022-10-12 CVE-2022-40871 Code Injection vulnerability in Dolibarr Erp/Crm
Dolibarr ERP & CRM <=15.0.3 is vulnerable to Eval injection.
network
low complexity
dolibarr CWE-94
critical
9.8
2022-06-13 CVE-2022-2060 Cross-site Scripting vulnerability in Dolibarr Erp/Crm
Cross-site Scripting (XSS) - Stored in GitHub repository dolibarr/dolibarr prior to 16.0.
network
low complexity
dolibarr CWE-79
5.4
2022-03-02 CVE-2022-0819 Unspecified vulnerability in Dolibarr Erp/Crm
Code Injection in GitHub repository dolibarr/dolibarr prior to 15.0.1.
network
low complexity
dolibarr
8.8
2022-02-25 CVE-2022-0746 Unspecified vulnerability in Dolibarr Erp/Crm
Business Logic Errors in GitHub repository dolibarr/dolibarr prior to 16.0.
network
low complexity
dolibarr
4.3
2022-02-23 CVE-2022-0731 Authorization Bypass Through User-Controlled Key vulnerability in Dolibarr Erp/Crm
Improper Access Control (IDOR) in GitHub repository dolibarr/dolibarr prior to 16.0.
network
low complexity
dolibarr CWE-639
6.5
2022-01-31 CVE-2022-0414 Unspecified vulnerability in Dolibarr Erp/Crm
Improper Validation of Specified Quantity in Input in Packagist dolibarr/dolibarr prior to 16.0.
network
low complexity
dolibarr
4.3
2022-01-14 CVE-2022-0224 SQL Injection vulnerability in Dolibarr Erp/Crm
dolibarr is vulnerable to Improper Neutralization of Special Elements used in an SQL Command
network
low complexity
dolibarr CWE-89
critical
9.8
2022-01-10 CVE-2022-0174 Unspecified vulnerability in Dolibarr Erp/Crm
Improper Validation of Specified Quantity in Input vulnerability in dolibarr dolibarr/dolibarr.
network
low complexity
dolibarr
4.3
2018-04-11 CVE-2017-9839 SQL Injection vulnerability in Dolibarr Erp/Crm
Dolibarr ERP/CRM is affected by SQL injection in versions before 5.0.4 via product/stats/card.php (type parameter).
network
low complexity
dolibarr CWE-89
8.8