En resumen
- CVE-2026-31018 es una vulnerabilidad ALTO (CVSS 8.8) que afecta a dolibarr/dolibarr, dolibarr erp/crm (dolibarr).
- Probabilidad de explotación en los próximos 30 días (EPSS): 0.27%, mayor que el 19.7% de las vulnerabilidades.
- Aún no hay una versión corregida: sigue el aviso del fabricante en Referencias.
Description
In Dolibarr ERP & CRM <= 22.0.4, PHP code detection and editing permission enforcement in the Website module is not applied consistently to all input parameters, allowing an authenticated user restricted to HTML/JavaScript editing to inject PHP code through unprotected inputs during website page creation.
A patch is available at https://github.com/Dolibarr/dolibarr/releases/tag/23.0.0.
NVD description
In Dolibarr ERP & CRM <= 22.0.4, PHP code detection and editing permission enforcement in the Website module is not applied consistently to all input parameters, allowing an authenticated user restricted to HTML/JavaScript editing to inject PHP code through unprotected inputs during website page creation.
Más vulnerabilidades de dolibarr/dolibarr
Ver todo →Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free