Vulnerabilities > Dolibarr
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2018-12-26 | CVE-2018-19799 | Cross-site Scripting vulnerability in Dolibarr Dolibarr ERP/CRM through 8.0.3 has /exports/export.php?datatoexport= XSS. | 6.1 |
| 2018-07-08 | CVE-2018-13450 | SQL Injection vulnerability in Dolibarr Erp/Crm 7.0.3 SQL injection vulnerability in product/card.php in Dolibarr ERP/CRM version 7.0.3 allows remote attackers to execute arbitrary SQL commands via the status_batch parameter. | 9.8 |
| 2018-07-08 | CVE-2018-13449 | SQL Injection vulnerability in Dolibarr Erp/Crm 7.0.3 SQL injection vulnerability in product/card.php in Dolibarr ERP/CRM version 7.0.3 allows remote attackers to execute arbitrary SQL commands via the statut_buy parameter. | 9.8 |
| 2018-07-08 | CVE-2018-13448 | SQL Injection vulnerability in Dolibarr Erp/Crm 7.0.3 SQL injection vulnerability in product/card.php in Dolibarr ERP/CRM version 7.0.3 allows remote attackers to execute arbitrary SQL commands via the country_id parameter. | 9.8 |
| 2018-07-08 | CVE-2018-13447 | SQL Injection vulnerability in Dolibarr Erp/Crm 7.0.3 SQL injection vulnerability in product/card.php in Dolibarr ERP/CRM version 7.0.3 allows remote attackers to execute arbitrary SQL commands via the statut parameter. | 9.8 |
| 2018-05-22 | CVE-2018-9019 | SQL Injection vulnerability in multiple products SQL Injection vulnerability in Dolibarr before version 7.0.2 allows remote attackers to execute arbitrary SQL commands via the sortfield parameter to /accountancy/admin/accountmodel.php, /accountancy/admin/categories_list.php, /accountancy/admin/journals_list.php, /admin/dict.php, /admin/mails_templates.php, or /admin/website.php. | 9.8 |
| 2018-05-22 | CVE-2018-10095 | Cross-site Scripting vulnerability in Dolibarr Cross-site scripting (XSS) vulnerability in Dolibarr before 7.0.2 allows remote attackers to inject arbitrary web script or HTML via the foruserlogin parameter to adherents/cartes/carte.php. | 6.1 |
| 2018-05-22 | CVE-2018-10094 | SQL Injection vulnerability in Dolibarr SQL injection vulnerability in Dolibarr before 7.0.2 allows remote attackers to execute arbitrary SQL commands via vectors involving integer parameters without quotes. | 9.8 |
| 2018-05-22 | CVE-2018-10092 | Missing Authorization vulnerability in Dolibarr The admin panel in Dolibarr before 7.0.2 might allow remote attackers to execute arbitrary commands by leveraging support for updating the antivirus command and parameters used to scan file uploads. | 8.0 |
| 2018-04-11 | CVE-2017-9839 | SQL Injection vulnerability in Dolibarr Erp/Crm Dolibarr ERP/CRM is affected by SQL injection in versions before 5.0.4 via product/stats/card.php (type parameter). | 8.8 |