CVE-2019-25450CWE-89

Dolibarr ERP/CRM 10.0.1 SQL Injection via card.php

High · published February 22, 2026

CVSS v4.0
7.1
EPSS
0%
Percentile
27.8
In the wild
Unconfirmed
What it is

Dolibarr ERP/CRM 10.0.1 contains multiple SQL injection vulnerabilities that allow authenticated attackers to manipulate database queries by injecting SQL code through POST parameters. Attackers can inject malicious SQL through parameters like actioncode, demand_reason_id, and availability_id in card.php endpoints to extract sensitive database information using boolean-based blind, error-based, and time-based blind techniques.

The record
Technical detail
CVSS v4.0
7.1 · HIGH
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N
EPSS
0.00353 · 27.8th percentile
Weakness
CWE-89 · Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Published
2026-02-22T13:18Z
EPSS history
Timeline
  • 22 FEB 13:18Z
    Dolibarr ERP/CRM 10.0.1 SQL Injection via card.php
    cvelistv5