Vulnerabilities > Dolibarr > Dolibarr ERP CRM
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2022-06-08 | CVE-2022-30875 | Cross-site Scripting vulnerability in Dolibarr Erp/Crm 12.0.5 Dolibarr 12.0.5 is vulnerable to Cross Site Scripting (XSS) via Sql Error Page. | 6.1 |
| 2022-03-31 | CVE-2021-37517 | Incorrect Authorization vulnerability in Dolibarr Erp/Crm 13.0.2 An Access Control vulnerability exists in Dolibarr ERP/CRM 13.0.2, fixed version is 14.0.0,in the forgot-password function becuase the application allows email addresses as usernames, which can cause a Denial of Service. | 7.5 |
| 2022-03-31 | CVE-2021-36625 | SQL Injection vulnerability in Dolibarr Erp/Crm 13.0.2 An SQL Injection vulnerability exists in Dolibarr ERP/CRM 13.0.2 (fixed version is 14.0.0) via a POST request to the country_id parameter in an UPDATE statement. | 8.8 |
| 2022-03-02 | CVE-2022-0819 | Unspecified vulnerability in Dolibarr Erp/Crm Code Injection in GitHub repository dolibarr/dolibarr prior to 15.0.1. | 8.8 |
| 2022-02-25 | CVE-2022-0746 | Unspecified vulnerability in Dolibarr Erp/Crm Business Logic Errors in GitHub repository dolibarr/dolibarr prior to 16.0. | 4.3 |
| 2022-02-23 | CVE-2022-0731 | Authorization Bypass Through User-Controlled Key vulnerability in Dolibarr Erp/Crm Improper Access Control (IDOR) in GitHub repository dolibarr/dolibarr prior to 16.0. | 6.5 |
| 2022-01-31 | CVE-2022-0414 | Unspecified vulnerability in Dolibarr Erp/Crm Improper Validation of Specified Quantity in Input in Packagist dolibarr/dolibarr prior to 16.0. | 4.3 |
| 2022-01-14 | CVE-2022-0224 | SQL Injection vulnerability in Dolibarr Erp/Crm dolibarr is vulnerable to Improper Neutralization of Special Elements used in an SQL Command | 9.8 |
| 2022-01-10 | CVE-2022-0174 | Unspecified vulnerability in Dolibarr Erp/Crm Improper Validation of Specified Quantity in Input vulnerability in dolibarr dolibarr/dolibarr. | 4.3 |
| 2022-01-02 | CVE-2022-22293 | Cross-site Scripting vulnerability in Dolibarr Erp/Crm 7.0.2 admin/limits.php in Dolibarr 7.0.2 allows HTML injection, as demonstrated by the MAIN_MAX_DECIMALS_TOT parameter. | 5.4 |