CVE-2026-116218High· 7.6▾ TwilightDolibarr ERP CRM 19.0.0 before 23.0.4 contains an SQL injection vulnerability that allows authenticated API users to inject SQL via the type field of the third-party bankaccounts REST endpoint. Attackers with only societe/creer permissio…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 41.8 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Dolibarr ERP CRM 19.0.0 before 23.0.4 contains an SQL injection vulnerability that allows authenticated API users to inject SQL via the type field of the third-party bankaccounts REST endpoint. Attackers with only societe/creer permission can break out of the unescaped type value in CompanyBankAccount::create() to read password hashes and API keys via time-based blind subqueries.
dolibarr >= 19.0.0 < 23.0.4Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-81728High· 8.1Dolibarr before 24.0.0 SQL Injection via the CSV and XLSX Import Update Keys
CVE-2026-116219High· 7.2Dolibarr ERP CRM before 24.0.0 OS Command Injection via mysqldump Parameter
CVE-2026-110874Medium· 6.6Dolibarr before 23.0.4 contains a PHP object injection vulnerability in jsonOrUnserialize() in functions.lib.php, which calls unserialize() without class restrictions when json_decode() fails
CVE-2026-107706Medium· 4.3Dolibarr ERP CRM before 24.0.2 contains an incorrect authorization vulnerability in htdocs/core/ajax/updateextrafield.php that checks only read permission before writing extrafield values
CVE-2026-81729Medium· 6.5Dolibarr before 23.0.4 Incorrect Authorization on REST API Document Deletion
CVE-2026-81730High· 8.2Dolibarr 9.0.0 through 23.0.4 Path Traversal via EmailCollector Attachment Filename