https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-27T10:00:44.043578+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-333002 EUVD-2026-333002 2026-10-27T10:00:44.046464+00:00 EUVD-2026-333002 https://cve.radiocsirt.org/vuln/fkie_cve-2026-31018 fkie_cve-2026-31018 2026-10-27T10:00:44.046505+00:00

In Dolibarr ERP & CRM <= 22.0.4, PHP code detection and editing permission enforcement in the Website module is not applied consistently to all input parameters, allowing an authenticated user restricted to HTML/JavaScript editing to inject PHP code through unprotected inputs during website page creation.

 https://cve.radiocsirt.org/vuln/ghsa-676v-wh57-p375 GHSA-676v-wh57-p375 — Dolibarr Allows Code Injection through its Website Module 2026-10-27T10:00:44.046550+00:00

Affected: Packagist: dolibarr/dolibarr

In Dolibarr ERP & CRM <= 22.0.4, PHP code detection and editing permission enforcement in the Website module is not applied consistently to all input parameters, allowing an authenticated user restricted to HTML/JavaScript editing to inject PHP code through unprotected inputs during website page creation.

A patch is available at https://github.com/Dolibarr/dolibarr/releases/tag/23.0.0.

 https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-31018 UBUNTU-CVE-2026-31018 2026-10-27T10:00:44.046619+00:00

Affected: Ubuntu:Pro:16.04:LTS: dolibarr

In Dolibarr ERP & CRM <= 22.0.4, PHP code detection and editing permission enforcement in the Website module is not applied consistently to all input parameters, allowing an authenticated user restricted to HTML/JavaScript editing to inject PHP code through unprotected inputs during website page creation.