Vulnerabilities > Dolibarr > Critical
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2018-05-22 | CVE-2018-9019 | SQL Injection vulnerability in multiple products SQL Injection vulnerability in Dolibarr before version 7.0.2 allows remote attackers to execute arbitrary SQL commands via the sortfield parameter to /accountancy/admin/accountmodel.php, /accountancy/admin/categories_list.php, /accountancy/admin/journals_list.php, /admin/dict.php, /admin/mails_templates.php, or /admin/website.php. | 9.8 |
| 2018-05-22 | CVE-2018-10094 | SQL Injection vulnerability in Dolibarr SQL injection vulnerability in Dolibarr before 7.0.2 allows remote attackers to execute arbitrary SQL commands via vectors involving integer parameters without quotes. | 9.8 |
| 2017-12-27 | CVE-2017-17900 | SQL Injection vulnerability in Dolibarr Erp/Crm 6.0.4 SQL injection vulnerability in fourn/index.php in Dolibarr ERP/CRM version 6.0.4 allows remote attackers to execute arbitrary SQL commands via the socid parameter. | 9.8 |
| 2017-12-27 | CVE-2017-17899 | SQL Injection vulnerability in Dolibarr Erp/Crm 6.0.4 SQL injection vulnerability in adherents/subscription/info.php in Dolibarr ERP/CRM version 6.0.4 allows remote attackers to execute arbitrary SQL commands via the rowid parameter. | 9.8 |
| 2017-12-27 | CVE-2017-17897 | SQL Injection vulnerability in Dolibarr Erp/Crm 6.0.4 SQL injection vulnerability in comm/multiprix.php in Dolibarr ERP/CRM version 6.0.4 allows remote attackers to execute arbitrary SQL commands via the id parameter. | 9.8 |
| 2017-09-11 | CVE-2017-14242 | SQL Injection vulnerability in Dolibarr 6.0.0 SQL injection vulnerability in don/list.php in Dolibarr version 6.0.0 allows remote attackers to execute arbitrary SQL commands via the statut parameter. | 9.8 |
| 2017-09-11 | CVE-2017-14238 | SQL Injection vulnerability in Dolibarr 6.0.0 SQL injection vulnerability in admin/menus/edit.php in Dolibarr ERP/CRM version 6.0.0 allows remote attackers to execute arbitrary SQL commands via the menuId parameter. | 9.8 |
| 2017-06-05 | CVE-2017-9435 | SQL Injection vulnerability in Dolibarr Dolibarr ERP/CRM before 5.0.3 is vulnerable to a SQL injection in user/index.php (search_supervisor and search_statut parameters). | 9.8 |
| 2017-05-10 | CVE-2017-7888 | Inadequate Encryption Strength vulnerability in Dolibarr Erp/Crm 4.0.4 Dolibarr ERP/CRM 4.0.4 stores passwords with the MD5 algorithm, which makes brute-force attacks easier. | 9.8 |
| 2017-05-10 | CVE-2017-7886 | SQL Injection vulnerability in Dolibarr Erp/Crm 4.0.4 Dolibarr ERP/CRM 4.0.4 has SQL Injection in doli/theme/eldy/style.css.php via the lang parameter. | 9.8 |