What’s Vulnerable › Vulnerabilities

CVE-2019-25450: Dolibarr ERP/CRM 10.0.1 SQL Injection via card.php

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2026-02-22 · updated 2026-06-17
• Weakness: CWE-89

Description

Dolibarr ERP/CRM 10.0.1 contains multiple SQL injection vulnerabilities that allow authenticated attackers to manipulate database queries by injecting SQL code through POST parameters. Attackers can inject malicious SQL through parameters like actioncode, demand_reason_id, and availability_id in card.php endpoints to extract sensitive database information using boolean-based blind, error-based, and time-based blind techniques.

Affected products

• dolibarr: 10.0.1

References

• https://www.exploit-db.com/exploits/47370
• https://www.vulncheck.com/advisories/dolibarr-erpcrm-sql-injection-via-cardphp

Get alerted when CVE-2019-25450 or the next vulnerability affects your stack