CVE-2026-71511

Dolibarr before 24.0.0 contains a sensitive data exposure vulnerability in its Members REST API . Authenticated users with member-read privileges can query individual member or member list endpoints and retrieve bcrypt password verifiers that are not filtered by the base API serializer or the Mem...

CVE-2024-8529

CVE-2024-8529 LearnPress – WordPress LMS插件 = 4.2.7 - 未经身份验证的SQL注入（通过'cfields'） 描述 LearnPress – WordPress LMS插件在所有版本（包括4.2.7及之前版本）中，存在SQL注入漏洞，攻击者可通过/wp-json/lp/v1/courses/archive-course REST API端点的'cfields'参数注入SQL，原因是用户提供的参数转义不足且现有SQL查询缺少充分的预处理。这使得未经身份验证的攻击者能够将额外的SQL查询附加到已有查询中，从而窃取数据库中的敏感信息。...

CVE-2026-71510

Dolibarr versions prior to 24.0.0 are affected by a SQL injection in the users REST API. The root cause is that unsanitized filter parameters are spliced directly into SQL WHERE clauses without column restrictions, enabling authenticated users with user-read rights to extract sensitive data not e...

EUVD-2026-65083

Dolibarr before 24.0.0 contains a SQL injection vulnerability in the users REST API that allows authenticated attackers with user-read rights to extract sensitive data by splicing unsanitized filter parameters into SQL WHERE clauses without column restrictions. Attackers can perform binary search...

CVE-2026-71510 Dolibarr < 24.0.0 Users REST API SQL Injection via filter parameter

Dolibarr before 24.0.0 contains a SQL injection vulnerability in the users REST API that allows authenticated attackers with user-read rights to extract sensitive data by splicing unsanitized filter parameters into SQL WHERE clauses without column restrictions. Attackers can perform binary search...

CVE-2026-71509

Dolibarr versions before 24.0.0 contain an improper authorization vulnerability in the expense report REST API update endpoint. Authenticated users holding only expense-creation rights can directly set approval status and approver identity fields via the API, effectively bypassing the approval wo...

EUVD-2026-65082

Dolibarr before 24.0.0 contains an improper authorization vulnerability in the expense report REST API update endpoint that allows authenticated attackers with expense-creation rights to bypass the approval workflow by directly setting approval status and approver identity fields. Attackers can...

CVE-2026-71508 Dolibarr < 24.0.0 REST API Improper Authorization via User Update Endpoint

Dolibarr before 24.0.0 contains an improper authorization vulnerability in the user REST API update endpoint that allows attackers with user-write rights to modify payroll fields by exploiting an incomplete credential denylist that omits payroll columns. Attackers can rewrite salary, bonus, hourl...

CVE-2026-71508

Dolibarr before 24.0.0 is affected by an improper authorization flaw in the user REST API update endpoint. The root cause is an incomplete credential denylist that omits payroll columns, allowing an attacker who holds only user-write rights (without payroll rights) to modify salary, bonus, hourly...

EUVD-2026-65081

Dolibarr before 24.0.0 contains an improper authorization vulnerability in the user REST API update endpoint that allows attackers with user-write rights to modify payroll fields by exploiting an incomplete credential denylist that omits payroll columns. Attackers can rewrite salary, bonus, hourl...

CVE-2026-71507

Dolibarr before 24.0.0 is affected by a broken object-level authorization flaw in the REST API company bank account write routes. An authenticated user holding only third-party creation rights can create, replace, or delete bank account details of any company without needing read access to that c...

EUVD-2026-65080

Dolibarr before 24.0.0 contains a broken object-level authorization vulnerability in the REST API company bank account write routes that allows authenticated attackers with third-party creation rights to create, replace, or delete bank account details of any company without requiring read access ...

CVE-2026-71507 Dolibarr < 24.0.0 REST API Broken Object-Level Authorization via Bank Account Routes

Dolibarr before 24.0.0 contains a broken object-level authorization vulnerability in the REST API company bank account write routes that allows authenticated attackers with third-party creation rights to create, replace, or delete bank account details of any company without requiring read access ...

EUVD-2026-65079

Dolibarr before 24.0.0 contains an improper authorization vulnerability in the payments REST API delete endpoint that allows authenticated attackers with invoice-deletion rights to permanently delete any payment record by bypassing the intended payment-issuance rights check. Attackers can exploit...

CVE-2026-71506

Dolibarr (an open-source ERP/CRM) before 24.0.0 contains an improper authorization vulnerability in the payments REST API delete endpoint . An authenticated attacker holding invoice-deletion rights can bypass the intended payment-issuance rights check to permanently delete any payment record, reg...

CVE-2024-49328

CVE-2024-49328 WP REST API FNS ; rel="https://api.w.org/" X-Content-Type-Options: nosniff Access-Control-Expose-Headers: X-WP-Total, X-WP-TotalPages, Link Access-Control-Allow-Headers: Authorization, X-WP-Nonce, Content-Disposition, Content-MD5, Content-Type Allow: POST Content-Length: 191...

EUVD-2026-65078

Dolibarr before 24.0.0 contains a broken object-level authorization vulnerability in the REST API third-party site account write routes that allows authenticated attackers with third-party creation rights to overwrite the WebPortal password of any company by bypassing per-object access checks tha...

CVE-2026-71505

Dolibarr before 24.0.0 is affected by a Broken Object-Level Authorization (BOLA) vulnerability in the REST API third-party site account write routes . Per-object access checks are enforced only on read routes, leaving write endpoints unguarded. An authenticated attacker holding third-party creati...

CVE-2026-71505 Dolibarr < 24.0.0 REST API Broken Object-Level Authorization via Third-Party Write Route

Dolibarr before 24.0.0 contains a broken object-level authorization vulnerability in the REST API third-party site account write routes that allows authenticated attackers with third-party creation rights to overwrite the WebPortal password of any company by bypassing per-object access checks tha...

EUVD-2026-65076

Dolibarr before 24.0.0 contains an improper authorization vulnerability in the Members REST API that allows attackers with only member-creation rights to reset the password of any user account, including the system administrator, without verifying password-change permissions. Attackers can supply...