CVE-2014-3992: Dolibarr Erp/crm

Medium severity, CVSS 6.5. EPSS: 2% chance of exploitation in the next 30 days.

Multiple SQL injection vulnerabilities in Dolibarr ERP/CRM 3.5.3 allow remote authenticated users to execute arbitrary SQL commands via the (1) entity parameter in an update action to user/fiche.php or (2) sortorder parameter to user/group/index.php.

Affected products

• Dolibarr Dolibarr Erp/crm: version 3.5.3 only

Published 2014-07-11. Last modified 2026-06-17.