CVE-2026-81728

Dolibarr before 24.0.0 contains a SQL injection in its CSV and XLSX import wizard. The wizard reads its update keys with GETPOST'updatekeys', 'array' in htdocs/imports/import.php, which applies only the generic alphanohtml filter: that strips HTML but leaves SQL keywords, comment markers,...

PT-2026-82745

Name of the Vulnerable Software and Affected Versions Dolibarr versions prior to 24.0.0 Description A SQL injection exists in the CSV and XLSX import wizard. The issue occurs because the wizard reads update keys using the GETPOST'updatekeys','array' function in htdocs/imports/import.php, applying...