60 matches found
CVE-2026-89013
CVE-2026-89013 — Dolibarr hashp=shared Authorization Bypass Exploit for CVE-2026-89013: document.php and viewimage.php force NOLOGIN when the hashp parameter is present. The internal marker value shared skips share-token resolution, but the access-control override still fires for any non-empty...
Dolibarr < 24.0.0 - Authorization Bypass via hashp Parameter
Dolibarr ERP/CRM versions 23.0.4 through 24.0.0 contain an authorization bypass vulnerability in document.php and viewimage.php. The public share-link feature forces NOLOGIN when hashp is present, but the value 'shared' skips token resolution while the override still fires for any non-empty hashp...
EUVD-2026-104654
A vulnerability has been found in Dolibarr up to 23.0.2. The impacted element is an unknown function of the file htdocs/document.php of the component CSP. Such manipulation leads to protection mechanism failure. The attack can be executed remotely. Upgrading to version 24.0.0 is sufficient to...
CVE-2026-112361
A vulnerability has been found in Dolibarr up to 23.0.2. The impacted element is an unknown function of the file htdocs/document.php of the component CSP. Such manipulation leads to protection mechanism failure. The attack can be executed remotely. Upgrading to version 24.0.0 is sufficient to...
CVE-2026-112361 Dolibarr CSP document.php protection mechanism
A vulnerability has been found in Dolibarr up to 23.0.2. The impacted element is an unknown function of the file htdocs/document.php of the component CSP. Such manipulation leads to protection mechanism failure. The attack can be executed remotely. Upgrading to version 24.0.0 is sufficient to...
CVE-2026-112361 Dolibarr CSP document.php protection mechanism
A vulnerability has been found in Dolibarr up to 23.0.2. The impacted element is an unknown function of the file htdocs/document.php of the component CSP. Such manipulation leads to protection mechanism failure. The attack can be executed remotely. Upgrading to version 24.0.0 is sufficient to...
CVE-2026-112361
A vulnerability exists in Dolibarr versions up to 23.0.2 within the CSP component. The flaw resides in an unknown function of the htdocs/document.php file, which leads to a protection mechanism failure . This vulnerability can be exploited remotely . To remediate this issue, users should upgrade ...
PT-2026-117668
Name of the Vulnerable Software and Affected Versions Dolibarr versions prior to 24.0.0 Description A remote attack can cause a protection mechanism failure within the CSP component. The issue resides in an unknown function located in the htdocs/document.php file. Recommendations Upgrade to versi...
VulnCheck KEV: CVE-2026-89013
Dolibarr 23.0.4 before 24.0.1 contains an authorization bypass vulnerability that allows unauthenticated attackers to read arbitrary files through the document storage endpoints by supplying a crafted hashp parameter value. Attackers can send a request with hashp=shared to skip token validation...
Exploit for CVE-2026-89013
CVE-2026-89013 — Dolibarr hashp=shared Authorization Bypass E...
CVE-2026-89013 Dolibarr 23.0.4 < 24.0.1 Authorization Bypass via hashp Parameter in document.php
Dolibarr 23.0.4 before 24.0.1 contains an authorization bypass vulnerability that allows unauthenticated attackers to read arbitrary files through the document storage endpoints by supplying a crafted hashp parameter value. Attackers can send a request with hashp=shared to skip token validation...
CVE-2026-89013
Dolibarr 23.0.4 through 24.0.0 contains an authorization bypass in htdocs/document.php and htdocs/viewimage.php that allows unauthenticated attackers to read arbitrary files within the application's managed directories. The root cause is a regression (commit 5028dae981e, shipped in 23.0.4): suppl...
CVE-2026-89013 Dolibarr 23.0.4 < 24.0.1 Authorization Bypass via hashp Parameter in document.php
Dolibarr 23.0.4 before 24.0.1 contains an authorization bypass vulnerability that allows unauthenticated attackers to read arbitrary files through the document storage endpoints by supplying a crafted hashp parameter value. Attackers can send a request with hashp=shared to skip token validation...
Dolibarr ERP/CRM 3.2 Alpha - Multiple Directory Traversal Vulnerabilities Detection
Multiple directory traversal vulnerabilities in Dolibarr CMS 3.2.0 Alpha allow remote attackers to read arbitrary files and possibly execute arbitrary code via a .. dot dot in the 1 file parameter to document.php or 2 backtopage parameter in a create action to comm/action/fiche.php. !/usr/bin/env...
EUVD-2020-23651
Malware in sbrugna...
EUVD-2020-10379
Malware in sbrugna...
EUVD-2022-4732
Malicious code in bioql PyPI...
CVE-2024-30920
Cross Site Scripting vulnerability in DerbyNet v9.0 and below allows a remote attacker to execute arbitrary code via the render-document.php component...