CVE-2025-67486High· 7.2▾ TwilightDolibarr is an enterprise resource planning (ERP) and customer relationship management (CRM) software package. Versions 22.0.2 and earlier contains an authenticated remote code execution vulnerability in the user extrafields functionalit…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 39.6 · likelihood 0.2 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Oct 5.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
0.9%
Last analysed / modified upstream
Dolibarr is an enterprise resource planning (ERP) and customer relationship management (CRM) software package. Versions 22.0.2 and earlier contains an authenticated remote code execution vulnerability in the user extrafields functionality. User-controlled input from the "computed value" field is passed to PHP's eval() function without adequate sanitization, allowing authenticated administrators to execute arbitrary PHP code on the server. As of time of publication, no patched versions are available.
dolibarr_erp/crm <= 22.0.2Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2018-25357Critical· 9.8Dolibarr ERP CRM 7.0.3 contains a remote code execution vulnerability that allows unauthenticated attackers to execute arbitrary code by injecting PHP code through the db_name parameter
CVE-2019-25710High· 8.2Dolibarr ERP-CRM 8.0.4 contains an SQL injection vulnerability in the rowid parameter of the admin dict.php endpoint that allows attackers to execute arbitrary SQL queries
CVE-2026-34036Medium· 6.5Dolibarr is an enterprise resource planning (ERP) and customer relationship management (CRM) software package
CVE-2026-77923Medium· 4.3Dolibarr 21.0.0 before 24.0.0 contains an authorization bypass vulnerability caused by an inverted boolean condition in the private-project membership check within the clonetasks mass action handler in htdocs/core/actions_massactions.inc…
CVE-2026-33944High· 8.8Dolibarr has SQL Injection in societe/class/societe.class.php via localtax1_value parameter
CVE-2026-116219High· 7.2Dolibarr ERP CRM before 24.0.0 OS Command Injection via mysqldump Parameter