CVE-2018-16809: Dolibarr

Critical severity, CVSS 9.8. EPSS: 2.2% chance of exploitation in the next 30 days.

An issue was discovered in Dolibarr through 7.0.0. expensereport/card.php in the expense reports module allows SQL injection via the integer parameters qty and value_unit.

Affected products

• Dolibarr Dolibarr: from 3.8.0, up to and including 7.0.0

Published 2019-03-07. Last modified 2026-06-17.