Threats affecting pkg:github/dolibarr/dolibarr

22 threats

Severity	CVSS	Signals	Threat	Source	Published
High	8.8	EPSS 0.3%	CVE-2026-31018dolibarr · Improper Access Control High8.8EPSS 0.3%2026-04-21CVE Database V5CVE-2026-31018 In Dolibarr ERP & CRM <= 22.0.4, PHP code detection and editing permission enforcement in the Website module is not applied consistently to all input parameters, allowing an authenticated user restricted to HTML/JavaScript editing to inject PHP code through unprotected inputs during website page creation. EPSS 0.3%Vulnerability CWE-284	CVE Database V5	2026-04-21
High	8.8	EPSS 0.8%	CVE-2024-37821dolibarr · An Arbitrary File Upload High8.8EPSS 0.8%2024-06-18CVE Database V5CVE-2024-37821 An arbitrary file upload vulnerability in the Upload Template function of Dolibarr ERP CRM up to v19.0.1 allows attackers to execute arbitrary code via uploading a crafted .SQL file. EPSS 0.8%Vulnerability CWE-94	CVE Database V5	2024-06-18
High	8.8	EPSS 0.8%	CVE-2024-29477dolibarr · Code Injection High8.8EPSS 0.8%2024-04-03CVE Database V5CVE-2024-29477 Lack of sanitization during Installation Process in Dolibarr ERP CRM up to version 19.0.0 allows an attacker with adjacent access to the network to execute arbitrary code via a specifically crafted input. EPSS 0.8%Vulnerability CWE-94	CVE Database V5	2024-04-03

Page 2 of 2