dolibarr dolibarr

Name: dolibarr dolibarr
Brand: dolibarr

productUS

cpe:2.3:a:dolibarr:dolibarr:*:*:*:*:*:*:*:*

A product tracked in the threat graph; the vulnerabilities below are known to affect it.

KEV-listed

by severity

8critical9high15medium0low

updated 2026-10-28

vulnerabilities (32)

Related CVEs.

sort

ID	severity	EPSS	exploitable	patched	published	affected
CVE-2018-10094US	critical9.8	69.8% (99th)	Exploit	7.0.2	2018-05-22	< 7.0.2
CVE-2020-14209US	high8.8	27.5% (98th)	Exploit	11.0.5	2020-09-02	< 11.0.5
CVE-2018-19799US	medium6.1	4.48% (91st)	Exploit	no fix	2018-12-26	≤ 8.0.3
CVE-2020-13094US	medium5.4	1.15% (67th)	Exploit	11.0.4	2020-05-18	< 11.0.4
CVE-2018-10095US	medium6.1	86.8% (100th)	—	7.0.2	2018-05-22	< 7.0.2
CVE-2019-19212US	critical9.8	3.89% (90th)	—	no fix	2020-03-16	3.0.0 → 10.0.3
CVE-2018-9019US	critical9.8	3.79% (90th)	—	7.0.2	2018-05-22	< 7.0.2
CVE-2018-16809US	critical9.8	2.26% (83rd)	—	no fix	2019-03-07	3.8.0 → 7.0.0
CVE-2019-19209US	high7.5	2.08% (81st)	—	10.0.3	2020-03-16	3.0.0 → 10.0.3
CVE-2018-10092US	high8.0OT elevated	2.01% (81st)	—	7.0.2	2018-05-22	< 7.0.2
CVE-2020-12669US	high8.8OT elevated	1.96% (80th)	—	11.0.4	2020-05-06	< 11.0.4
CVE-2015-3935US	medium4.3	1.92% (80th)	—	no fix	2015-06-10	2 versions
CVE-2014-7137US	medium6.5	1.70% (77th)	—	no fix	2014-11-21	≤ 3.6.0
CVE-2015-8685US	medium6.1	1.70% (77th)	—	no fix	2016-01-15	≤ 3.8.2
CVE-2019-19211US	medium6.1	1.67% (77th)	—	10.0.4	2020-03-16	3.0.0 → 10.0.4
CVE-2020-14201US	medium6.5	1.63% (76th)	—	11.0.5	2020-08-21	< 11.0.5
CVE-2017-9435US	critical9.8	1.48% (74th)	—	no fix	2017-06-05	≤ 5.0.2
CVE-2017-9840US	high8.8	1.46% (73rd)	—	no fix	2017-06-25	≤ 5.0.3
CVE-2016-1912US	medium5.4	1.39% (72nd)	—	no fix	2016-01-15	≤ 3.8.2
CVE-2017-14242US	critical9.8	1.31% (70th)	—	no fix	2017-09-11	= 6.0.0
CVE-2017-14238US	critical9.8	1.31% (70th)	—	no fix	2017-09-11	= 6.0.0
CVE-2017-14240US	high7.5	1.16% (67th)	—	no fix	2017-09-11	= 6.0.0
CVE-2020-14443US	high8.8	1.15% (67th)	—	no fix	2020-06-18	≤ 11.0.3
CVE-2021-25957US	high8.8	1.06% (64th)	—	no fix	2021-08-17	2.8.1 → 13.0.2
CVE-2018-16808US	medium6.1	0.98% (62nd)	—	no fix	2019-03-07	3.8.0 → 7.0.0
CVE-2021-42220US	medium5.4	0.98% (62nd)	—	14.0.3	2021-12-15	< 14.0.3
CVE-2021-25956US	high7.2	0.94% (61st)	—	no fix	2021-08-17	3.3.1 → 13.0.2
CVE-2019-19210US	medium5.4	0.93% (60th)	—	10.0.3	2020-03-16	3.0.0 → 10.0.3
CVE-2021-25955US	critical9.0	0.89% (59th)	—	no fix	2021-08-15	2.8.1 → 13.0.2
CVE-2017-14241US	medium5.4	0.72% (54th)	—	no fix	2017-09-11	= 6.0.0
CVE-2017-14239US	medium5.4	0.72% (54th)	—	no fix	2017-09-11	= 6.0.0
CVE-2021-25954US	medium4.3OT elevated	0.70% (53rd)	—	no fix	2021-08-09	2.8.1 → 13.0.4

weaknesses (8)

The flaw types (CWEs) most of these CVEs share.

CWE-79Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')14 CVEs
CWE-89Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')9 CVEs
CWE-284Improper Access Control2 CVEs
CWE-434Unrestricted Upload of File with Dangerous Type2 CVEs
CWE-863Incorrect Authorization2 CVEs
CWE-20Improper Input Validation1 CVEs
CWE-200Exposure of Sensitive Information to an Unauthorized Actor1 CVEs
CWE-269Improper Privilege Management1 CVEs

sources (1)

Which sources assert this record, and when.

USNVD / CVE32 CVEs

scry

Products carry known vulnerabilities once they are exposed to the internet. See what is exposed on your perimeter with a free passive scan.

Free scan