CVE-2026-110874Medium· 6.6▾ SunlitDolibarr before 23.0.4 contains a PHP object injection vulnerability in jsonOrUnserialize() in functions.lib.php, which calls unserialize() without class restrictions when json_decode() fails. Attackers able to write stored extrafields, …
▾ Sunlit zone — Low / medium · no exploitation signal
impact 36.3 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Oct 16.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
0.5%
Dolibarr before 23.0.4 contains a PHP object injection vulnerability in jsonOrUnserialize() in functions.lib.php, which calls unserialize() without class restrictions when json_decode() fails. Attackers able to write stored extrafields, export configurations or blocked log entries can plant serialized objects that trigger gadget chains for code execution or file manipulation.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-116219High· 7.2Dolibarr ERP CRM before 24.0.0 OS Command Injection via mysqldump Parameter
CVE-2026-116218High· 7.6Dolibarr ERP CRM 19.0.0 before 23.0.4 SQL Injection via bankaccounts API type field
CVE-2026-107706Medium· 4.3Dolibarr ERP CRM before 24.0.2 contains an incorrect authorization vulnerability in htdocs/core/ajax/updateextrafield.php that checks only read permission before writing extrafield values
CVE-2026-81729Medium· 6.5Dolibarr before 23.0.4 Incorrect Authorization on REST API Document Deletion
CVE-2026-81728High· 8.1Dolibarr before 24.0.0 SQL Injection via the CSV and XLSX Import Update Keys
CVE-2026-81730High· 8.2Dolibarr 9.0.0 through 23.0.4 Path Traversal via EmailCollector Attachment Filename