{"id":"CVE-2019-25450","url":"https://www.cyber-defence.io/tools/cve/CVE-2019-25450","generatedAt":"2026-10-28T00:53:51.826Z","title":"Dolibarr ERP/CRM 10.0.1 contains multiple SQL injection vulnerabilities that allow authenticated attackers to manipulate database queries by injecting SQL code through POST parameters.","description":"Dolibarr ERP/CRM 10.0.1 contains multiple SQL injection vulnerabilities that allow authenticated attackers to manipulate database queries by injecting SQL code through POST parameters. Attackers can inject malicious SQL through parameters like actioncode, demand_reason_id, and availability_id in card.php endpoints to extract sensitive database information using boolean-based blind, error-based, and time-based blind techniques.","published":"2026-02-22T14:16:02.000Z","lastModified":"2026-06-17T02:32:24.000Z","status":"Modified","sourceIdentifier":"disclosure@vulncheck.com","cvss":{"version":"4.0","score":7.1,"severity":"HIGH","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M"},"cwe":["CWE-89"],"affected":["dolibarr/dolibarr erp\\/crm"],"epss":{"score":0.00353,"percentile":0.28746,"date":"2026-10-26","history":[]},"kev":{"listed":false},"exploits":{"count":0,"verified":false,"firstPublished":null,"source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[]},"verdict":{"level":"high","text":"High impact if exploited, but EPSS currently rates exploitation as unlikely (0.35%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit."},"changes":[],"references":[{"url":"https://www.exploit-db.com/exploits/47370","tags":["Exploit","VDB Entry"],"source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/dolibarr-erpcrm-sql-injection-via-cardphp","tags":["Broken Link"],"source":"disclosure@vulncheck.com"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2019-25450","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}