| Package | Affected versions | Patched versions |
|---|---|---|
| dolibarr/dolibarr | ≥ 13.0.2, < 14.0.0 | 14.0.0 |
| dolibarr erp/crm | = 13.0.2 |
The website builder module in Dolibarr 13.0.2 allows remote PHP code execution because of an incomplete protection mechanism in which system, exec, and shell_exec are blocked but backticks are not blocked.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free