CVE-2018-25357Critical· 9.8▾ AbyssalPoC available

Dolibarr ERP CRM 7.0.3 contains a remote code execution vulnerability that allows unauthenticated attackers to execute arbitrary code by injecting PHP code through the db_name parameter

▾ Abyssal zone — Critical with a public exploit or in-the-wild use

Depth score66/ 100 · Elevated

impact 53.9 · likelihood 0.3 · exploitation 12

⚡ Agent-ready:Raw markdown ↗JSON ↗

Proof of concept

A public proof-of-concept already exists for this vulnerability — see Exploit availability below.

…

Published

May 23, 2026

Updated

Oct 8, 2026

CVSS

9.8

Vendor

dolibarr

Product

dolibarr_erp/crm

CWE

CWE-94

Depth score

66 · Elevated

EPSS

1.7% · p77

Platforms

—

Source

NVD

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

decided 2026-05-26

Exploitation: poc
Automatable: yes
Technical impact: total

Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.

Timeline

Disclosure to exploitation, from the record and what we observed since indexing it.

3 events · 138 days

May 23, 2026Published
Disclosed via NVD
Oct 8, 2026Record revised
Last analysed / modified upstream
Oct 8, 2026EPSS first tracked
1.7%

dolibarr CWE-94 #nvd #cve.org #exploit-available

Affected

dolibarr_erp/crm <= 7.0.3

Full technical detail▾

Overview

Dolibarr ERP CRM 7.0.3 contains a remote code execution vulnerability that allows unauthenticated attackers to execute arbitrary code by injecting PHP code through the db_name parameter. Attackers can send a POST request to install/step1.php with malicious PHP code in the db_name parameter, then execute commands via the check.php endpoint using the cmd GET parameter.

Affected

dolibarr_erp/crm <= 7.0.3

Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

References

Related vulnerabilities

Connected by shared product, vendor, weakness, or advisory.

#nvd#cve.org#exploit-available

← Back to feed

CVE-2018-25357Critical· 9.8▾ AbyssalPoC available

Dolibarr ERP CRM 7.0.3 contains a remote code execution vulnerability that allows unauthenticated attackers to execute arbitrary code by injecting PHP code through the db_name parameter

▾ Abyssal zone — Critical with a public exploit or in-the-wild use

Depth score66/ 100 · Elevated

impact 53.9 · likelihood 0.3 · exploitation 12

⚡ Agent-ready:Raw markdown ↗JSON ↗

Proof of concept

A public proof-of-concept already exists for this vulnerability — see Exploit availability below.

…

Published

May 23, 2026

Updated

Oct 8, 2026

CVSS

9.8

Vendor

dolibarr

Product

dolibarr_erp/crm

CWE

CWE-94

Depth score

66 · Elevated

EPSS

1.7% · p77

Platforms

—

Source

NVD

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

decided 2026-05-26

Exploitation: poc
Automatable: yes
Technical impact: total

Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.

Timeline

Disclosure to exploitation, from the record and what we observed since indexing it.

3 events · 138 days

May 23, 2026Published
Disclosed via NVD
Oct 8, 2026Record revised
Last analysed / modified upstream
Oct 8, 2026EPSS first tracked
1.7%

dolibarr CWE-94 #nvd #cve.org #exploit-available

Affected

dolibarr_erp/crm <= 7.0.3

Full technical detail▾

Overview

Affected

dolibarr_erp/crm <= 7.0.3

Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

References

Related vulnerabilities

Connected by shared product, vendor, weakness, or advisory.

#nvd#cve.org#exploit-available