EUVD-2026-109810

Dolibarr ERP CRM 19.0.0 before 23.0.4 contains an SQL injection vulnerability that allows authenticated API users to inject SQL via the type field of the third-party bankaccounts REST endpoint. Attackers with only societe/creer permission can break out of the unescaped type value in...

CVE-2026-116218

Dolibarr ERP CRM version 19.0.0 before 23.0.4 is vulnerable to an SQL injection vulnerability. The flaw exists in the CompanyBankAccount::create() method because the type field of the third-party bankaccounts REST endpoint is not properly escaped. Authenticated API users with only societe/creer p...

CVE-2026-116218 Dolibarr ERP CRM 19.0.0 before 23.0.4 SQL Injection via bankaccounts API type field

Dolibarr ERP CRM 19.0.0 before 23.0.4 contains an SQL injection vulnerability that allows authenticated API users to inject SQL via the type field of the third-party bankaccounts REST endpoint. Attackers with only societe/creer permission can break out of the unescaped type value in...