Vulnerability GHSA-676v-wh57-p375
Advisory details are being prepared in the background.
High Risk
HIGH RISK
CVSS Score: 8.8
Score Range: 7.0–8.9
High severity vulnerabilities (CVSS 7.0–8.9). Serious vulnerabilities that should be prioritized soon after critical fixes.
6 months ago
April 21, 2026 at 03:32 PM UTC
Dolibarr Allows Code Injection through its Website Module
3.6.0-beta and 3.6.0 - 3.8.0-beta and 3.8.0 - 3.9.0-rc and 3.9.0-rc2 and 3.9.0 - 4.0.0-beta and 4.0.0-rc and 4.0.0-rc2 and 4.0.0 - 5.0.0-beta and 5.0.0-rc1 and 5.0.0-rc2 and 5.0.0 - 6.0.0-beta and 6.0.0-rc and 6.0.0 - 15.0.3
3.6.0-beta and 3.6.0 - 3.8.0-beta and 3.8.0 - 3.9.0-rc and 3.9.0-rc2 and 3.9.0 - 4.0.0-beta and 4.0.0-rc and 4.0.0-rc2 and 4.0.0 - 5.0.0-beta and 5.0.0-rc1 and 5.0.0-rc2 and 5.0.0 - 6.0.0-beta and 6.0.0-rc and 6.0.0 - 15.0.3
Related Vulnerabilities
Other vulnerabilities affecting the same packages
High Risk
9 days ago
Dolibarr has SQL Injection in societe/class/societe.class.php via localtax1_value parameter
3.6.0-beta and 3.6.0 - 3.8.0-beta and 3.8.0 - 3.9.0-rc and 3.9.0-rc2 and 3.9.0 - 4.0.0-beta and 4.0.0-rc and 4.0.0-rc2 and 4.0.0 - 5.0.0-beta and 5.0.0-rc1 and 5.0.0-rc2 and 5.0.0 - 6.0.0-beta and 6.0.0-rc and 6.0.0 - 15.0.3 GHSA-v5fq-cf5m-vwv7
3.6.0-beta and 3.6.0 - 3.8.0-beta and 3.8.0 - 3.9.0-rc and 3.9.0-rc2 and 3.9.0 - 4.0.0-beta and 4.0.0-rc and 4.0.0-rc2 and 4.0.0 - 5.0.0-beta and 5.0.0-rc1 and 5.0.0-rc2 and 5.0.0 - 6.0.0-beta and 6.0.0-rc and 6.0.0 - 15.0.3 GHSA-v5fq-cf5m-vwv7
Medium Risk
5 months ago
Dolibarr ERP CRM is vulnerable to Improper Authorization through its Leave Request REST API
3.6.0-beta and 3.6.0 - 3.8.0-beta and 3.8.0 - 3.9.0-rc and 3.9.0-rc2 and 3.9.0 - 4.0.0-beta and 4.0.0-rc and 4.0.0-rc2 and 4.0.0 - 5.0.0-beta and 5.0.0-rc1 and 5.0.0-rc2 and 5.0.0 - 6.0.0-beta and 6.0.0-rc and 6.0.0 - 15.0.3 GHSA-7fg5-vc77-69fp
3.6.0-beta and 3.6.0 - 3.8.0-beta and 3.8.0 - 3.9.0-rc and 3.9.0-rc2 and 3.9.0 - 4.0.0-beta and 4.0.0-rc and 4.0.0-rc2 and 4.0.0 - 5.0.0-beta and 5.0.0-rc1 and 5.0.0-rc2 and 5.0.0 - 6.0.0-beta and 6.0.0-rc and 6.0.0 - 15.0.3 GHSA-7fg5-vc77-69fp
Critical
5 months ago
Dolibarr ERP CRM contains a remote code evaluation vulnerability
3.6.0-beta and 3.6.0 - 3.8.0-beta and 3.8.0 - 3.9.0-rc and 3.9.0-rc2 and 3.9.0 - 4.0.0-beta and 4.0.0-rc and 4.0.0-rc2 and 4.0.0 - 5.0.0-beta and 5.0.0-rc1 and 5.0.0-rc2 and 5.0.0 - 6.0.0-beta and 6.0.0-rc and 6.0.0 - 7.0.3 GHSA-hxmh-2xc4-c894
3.6.0-beta and 3.6.0 - 3.8.0-beta and 3.8.0 - 3.9.0-rc and 3.9.0-rc2 and 3.9.0 - 4.0.0-beta and 4.0.0-rc and 4.0.0-rc2 and 4.0.0 - 5.0.0-beta and 5.0.0-rc1 and 5.0.0-rc2 and 5.0.0 - 6.0.0-beta and 6.0.0-rc and 6.0.0 - 7.0.3 GHSA-hxmh-2xc4-c894
Low Risk
6 months ago
Dolibarr has Insufficient Verification of Data Authenticity
3.6.0-beta and 3.6.0 - 3.8.0-beta and 3.8.0 - 3.9.0-rc and 3.9.0-rc2 and 3.9.0 - 4.0.0-beta and 4.0.0-rc and 4.0.0-rc2 and 4.0.0 - 5.0.0-beta and 5.0.0-rc1 and 5.0.0-rc2 and 5.0.0 - 6.0.0-beta and 6.0.0-rc and 6.0.0 - 15.0.3 GHSA-jggh-5rmh-r6h5
3.6.0-beta and 3.6.0 - 3.8.0-beta and 3.8.0 - 3.9.0-rc and 3.9.0-rc2 and 3.9.0 - 4.0.0-beta and 4.0.0-rc and 4.0.0-rc2 and 4.0.0 - 5.0.0-beta and 5.0.0-rc1 and 5.0.0-rc2 and 5.0.0 - 6.0.0-beta and 6.0.0-rc and 6.0.0 - 15.0.3 GHSA-jggh-5rmh-r6h5
Medium Risk
6 months ago
Dolibarr has an Injection issue
3.6.0-beta and 3.6.0 - 3.8.0-beta and 3.8.0 - 3.9.0-rc and 3.9.0-rc2 and 3.9.0 - 4.0.0-beta and 4.0.0-rc and 4.0.0-rc2 and 4.0.0 - 5.0.0-beta and 5.0.0-rc1 and 5.0.0-rc2 and 5.0.0 - 6.0.0-beta and 6.0.0-rc and 6.0.0 - 15.0.3 GHSA-rvwr-q5hj-wq7g
3.6.0-beta and 3.6.0 - 3.8.0-beta and 3.8.0 - 3.9.0-rc and 3.9.0-rc2 and 3.9.0 - 4.0.0-beta and 4.0.0-rc and 4.0.0-rc2 and 4.0.0 - 5.0.0-beta and 5.0.0-rc1 and 5.0.0-rc2 and 5.0.0 - 6.0.0-beta and 6.0.0-rc and 6.0.0 - 15.0.3 GHSA-rvwr-q5hj-wq7g
Impacted packages
Timeline
Published
6 months ago
April 21, 2026 at 03:32 PM UTC
Last Modified
6 months ago
May 05, 2026 at 04:11 PM UTC