CVE-2023-4197: Dolibarr Erp/crm

High severity, CVSS 8.8. EPSS: 35.9% chance of exploitation in the next 30 days.

Improper input validation in Dolibarr ERP CRM <= v18.0.1 fails to strip certain PHP code from user-supplied input when creating a Website, allowing an attacker to inject and evaluate arbitrary PHP code.

Affected products

• Dolibarr Dolibarr Erp/crm: up to and including 18.0.1

Published 2023-11-01. Last modified 2026-06-17.