GitHub Advisoryadvisory · Packagist

GHSA-xxxg-x793-7fq3 Dolibarr has SQL injection vulnerability in the rowid parameter of the admin dict.php

HIGH Published 2026-04-12 Modified 2026-04-18 Official page ↗
Aliases
CVE-2019-25710
Ecosystem
Packagist
Packages
dolibarr/dolibarr
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
Weaknesses
CWE-89
Reviewed
2026-04-18

Affected packages

• Packagist dolibarr/dolibarr: <= 8.0.4 (no fix yet)

Description

Dolibarr ERP-CRM 8.0.4 contains an SQL injection vulnerability in the rowid parameter of the admin dict.php endpoint that allows attackers to execute arbitrary SQL queries. Attackers can inject malicious SQL code through the rowid POST parameter to extract sensitive database information using error-based SQL injection techniques.

Related

Alias · CVE (1)

  • CVE-2019-25710 Dolibarr ERP-CRM 8.0.4 contains an SQL injection vulnerability in the rowid parameter of the admin dict.php endpoint that allows attackers… vulnerability

Weakness · CWE (1)

  • CWE-89 Improper Neutralization of Special Elements used in an SQL Command weakness

References