Servers and applications
CVE-2018-10092
The admin panel in Dolibarr before 7.0.2 might allow remote attackers to execute arbitrary commands by leveraging support for updating the antivirus command and parameters used to scan file uploads.
- Severity
- High 8.0
- Published
- 22 May 2018
- Last changed
- 17 Jun 2026
- Added to UpHeron
- 1 Nov 2026
- Fixed in
- 7.0.2
- Exploit chance
- 2% in the next 30 daysHigher than 80% of CVEs. EPSS by FIRST, 10 Nov 2026
- Weakness
- Missing authorization (CWE-862)
- Attack
- Over the network · Needs a user account · Needs someone to click or open something
- Attacker can
- Read data · Change data · Take it down
- CVSS vector
CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H- Sources
- NVD
Affected software
| Software | Affected versions |
|---|---|
Dolibarr ERP CRMServers and applications · cpe:a:dolibarr:dolibarr |
|