{"affected":[{"product":"dolibarr","source":"CNA: GitHub_M","vendor":"Dolibarr","versions":[{"status":"affected","version":"< 22.0.5"},{"status":"affected","version":">= 23.0.0, < 23.0.2"}]},{"defaultStatus":"unaffected","ecosystem":"Packagist","packageName":"dolibarr/dolibarr","product":"dolibarr/dolibarr","source":"OSV GHSA-v5fq-cf5m-vwv7","vendor":"","versions":[{"status":"affected","version":"10.0.0","versionType":"Packagist"},{"status":"affected","version":"10.0.1","versionType":"Packagist"},{"status":"affected","version":"10.0.2","versionType":"Packagist"},{"status":"affected","version":"10.0.3","versionType":"Packagist"},{"status":"affected","version":"10.0.4","versionType":"Packagist"},{"status":"affected","version":"10.0.5","versionType":"Packagist"},{"status":"affected","version":"10.0.6","versionType":"Packagist"},{"status":"affected","version":"10.0.7","versionType":"Packagist"},{"status":"affected","version":"11.0.0","versionType":"Packagist"},{"status":"affected","version":"11.0.1","versionType":"Packagist"},{"status":"affected","version":"11.0.2","versionType":"Packagist"},{"status":"affected","version":"11.0.3","versionType":"Packagist"},{"status":"affected","version":"11.0.4","versionType":"Packagist"},{"status":"affected","version":"11.0.5","versionType":"Packagist"},{"status":"affected","version":"12.0.0","versionType":"Packagist"},{"status":"affected","version":"12.0.1","versionType":"Packagist"},{"status":"affected","version":"12.0.2","versionType":"Packagist"},{"status":"affected","version":"12.0.3","versionType":"Packagist"},{"status":"affected","version":"12.0.4","versionType":"Packagist"},{"status":"affected","version":"12.0.5","versionType":"Packagist"},{"status":"affected","version":"13.0.0","versionType":"Packagist"},{"status":"affected","version":"13.0.1","versionType":"Packagist"},{"status":"affected","version":"13.0.2","versionType":"Packagist"},{"status":"affected","version":"13.0.3","versionType":"Packagist"},{"status":"affected","version":"13.0.4","versionType":"Packagist"},{"status":"affected","version":"13.0.5","versionType":"Packagist"},{"status":"affected","version":"14.0.0","versionType":"Packagist"},{"status":"affected","version":"14.0.1","versionType":"Packagist"},{"status":"affected","version":"14.0.2","versionType":"Packagist"},{"status":"affected","version":"14.0.3","versionType":"Packagist"},{"status":"affected","version":"14.0.4","versionType":"Packagist"},{"status":"affected","version":"14.0.5","versionType":"Packagist"},{"status":"affected","version":"15.0.0","versionType":"Packagist"},{"status":"affected","version":"15.0.1","versionType":"Packagist"},{"status":"affected","version":"15.0.2","versionType":"Packagist"},{"status":"affected","version":"15.0.3","versionType":"Packagist"},{"status":"affected","version":"3.6.0","versionType":"Packagist"},{"status":"affected","version":"3.6.0-beta","versionType":"Packagist"},{"status":"affected","version":"3.6.1","versionType":"Packagist"},{"status":"affected","version":"3.6.2","versionType":"Packagist"},{"status":"affected","version":"3.6.3","versionType":"Packagist"},{"status":"affected","version":"3.6.4","versionType":"Packagist"},{"status":"affected","version":"3.6.5","versionType":"Packagist"},{"status":"affected","version":"3.6.6","versionType":"Packagist"},{"status":"affected","version":"3.7.0","versionType":"Packagist"},{"status":"affected","version":"3.7.1","versionType":"Packagist"},{"status":"affected","version":"3.7.2","versionType":"Packagist"},{"status":"affected","version":"3.7.3","versionType":"Packagist"},{"status":"affected","version":"3.7.4","versionType":"Packagist"},{"status":"affected","version":"3.8.0","versionType":"Packagist"},{"status":"affected","version":"3.8.0-beta","versionType":"Packagist"},{"status":"affected","version":"3.8.1","versionType":"Packagist"},{"status":"affected","version":"3.8.2","versionType":"Packagist"},{"status":"affected","version":"3.8.3","versionType":"Packagist"},{"status":"affected","version":"3.8.4","versionType":"Packagist"},{"status":"affected","version":"3.9.0","versionType":"Packagist"},{"status":"affected","version":"3.9.0-rc","versionType":"Packagist"},{"status":"affected","version":"3.9.0-rc2","versionType":"Packagist"},{"status":"affected","version":"3.9.1","versionType":"Packagist"},{"status":"affected","version":"3.9.2","versionType":"Packagist"},{"status":"affected","version":"3.9.3","versionType":"Packagist"},{"status":"affected","version":"3.9.4","versionType":"Packagist"},{"status":"affected","version":"4.0.0","versionType":"Packagist"},{"status":"affected","version":"4.0.0-beta","versionType":"Packagist"},{"status":"affected","version":"4.0.0-rc","versionType":"Packagist"},{"status":"affected","version":"4.0.0-rc2","versionType":"Packagist"},{"status":"affected","version":"4.0.1","versionType":"Packagist"},{"status":"affected","version":"4.0.2","versionType":"Packagist"},{"status":"affected","version":"4.0.3","versionType":"Packagist"},{"status":"affected","version":"4.0.4","versionType":"Packagist"},{"status":"affected","version":"4.0.5","versionType":"Packagist"},{"status":"affected","version":"4.0.6","versionType":"Packagist"},{"status":"affected","version":"5.0.0","versionType":"Packagist"},{"status":"affected","version":"5.0.0-beta","versionType":"Packagist"},{"status":"affected","version":"5.0.0-rc1","versionType":"Packagist"},{"status":"affected","version":"5.0.0-rc2","versionType":"Packagist"},{"status":"affected","version":"5.0.1","versionType":"Packagist"},{"status":"affected","version":"5.0.2","versionType":"Packagist"},{"status":"affected","version":"5.0.3","versionType":"Packagist"},{"status":"affected","version":"5.0.4","versionType":"Packagist"},{"status":"affected","version":"5.0.5","versionType":"Packagist"},{"status":"affected","version":"5.0.6","versionType":"Packagist"},{"status":"affected","version":"5.0.7","versionType":"Packagist"},{"status":"affected","version":"6.0.0","versionType":"Packagist"},{"status":"affected","version":"6.0.0-beta","versionType":"Packagist"},{"status":"affected","version":"6.0.0-rc","versionType":"Packagist"},{"status":"affected","version":"6.0.1","versionType":"Packagist"},{"status":"affected","version":"6.0.2","versionType":"Packagist"},{"status":"affected","version":"6.0.3","versionType":"Packagist"},{"status":"affected","version":"6.0.4","versionType":"Packagist"},{"status":"affected","version":"6.0.5","versionType":"Packagist"},{"status":"affected","version":"6.0.6","versionType":"Packagist"},{"status":"affected","version":"6.0.7","versionType":"Packagist"},{"status":"affected","version":"6.0.8","versionType":"Packagist"},{"status":"affected","version":"7.0.0","versionType":"Packagist"},{"status":"affected","version":"7.0.1","versionType":"Packagist"},{"status":"affected","version":"7.0.2","versionType":"Packagist"},{"status":"affected","version":"7.0.3","versionType":"Packagist"},{"status":"affected","version":"7.0.4","versionType":"Packagist"},{"status":"affected","version":"7.0.5","versionType":"Packagist"},{"status":"affected","version":"8.0.0","versionType":"Packagist"},{"status":"affected","version":"8.0.1","versionType":"Packagist"},{"status":"affected","version":"8.0.2","versionType":"Packagist"},{"status":"affected","version":"8.0.3","versionType":"Packagist"},{"status":"affected","version":"8.0.4","versionType":"Packagist"},{"status":"affected","version":"8.0.5","versionType":"Packagist"},{"status":"affected","version":"8.0.6","versionType":"Packagist"},{"status":"affected","version":"9.0.0","versionType":"Packagist"},{"status":"affected","version":"9.0.1","versionType":"Packagist"},{"status":"affected","version":"9.0.2","versionType":"Packagist"},{"status":"affected","version":"9.0.3","versionType":"Packagist"},{"status":"affected","version":"9.0.4","versionType":"Packagist"},{"events":[{"introduced":"0"},{"fixed":"22.0.5"}],"status":"unknown","version":"0","versionType":"ECOSYSTEM"}]},{"defaultStatus":"unaffected","ecosystem":"Packagist","packageName":"dolibarr/dolibarr","product":"dolibarr/dolibarr","source":"OSV GHSA-v5fq-cf5m-vwv7","vendor":"","versions":[{"events":[{"introduced":"23.0.0"},{"fixed":"23.0.2"}],"status":"unknown","version":"23.0.0","versionType":"ECOSYSTEM"}]}],"cveId":"CVE-2026-33944","cwes":["CWE-89"],"description":"Dolibarr is an open-source enterprise resource planning and customer relationship management application. Prior to 22.0.5 and 23.0.1, there is a SQL injection vulnerability in the Third Party company update functionality. The application concatenates the  localtax1_value  and  localtax2_value  properties into an SQL UPDATE statement without numeric conversion or other appropriate sanitization. An authenticated user with Third Party create or edit permission can submit crafted  lt1  or  lt2  POST parameters to read sensitive database information, including password hashes, API keys, and business data, or modify third-party records. This issue is fixed in versions 22.0.5 and 23.0.2.","epss":null,"exploits":[],"kev":null,"metrics":[{"score":8.8,"severity":"high","source":"CNA: GitHub_M","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"}],"modifiedAt":1793916004132,"publishedAt":1793914814793,"references":[{"source":"CNA: GitHub_M","tags":["x_refsource_CONFIRM"],"url":"https://github.com/Dolibarr/dolibarr/security/advisories/GHSA-v5fq-cf5m-vwv7"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/Dolibarr/dolibarr/pull/37632"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/Dolibarr/dolibarr/commit/a06b14b7dc39d33f8fa00c9b27f2913b494885cb"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/Dolibarr/dolibarr/commit/c83c13305240c2c0a3779e678b57238b32d15e7c"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/Dolibarr/dolibarr/releases/tag/22.0.5"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/Dolibarr/dolibarr/releases/tag/23.0.2"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://www.sec4check.pl/blog/posts/cve-dolibarr-sql-injection-localtax-third-party.html"},{"source":"OSV / GitHub Security Advisories","tags":["advisory"],"url":"https://github.com/advisories/GHSA-v5fq-cf5m-vwv7"},{"source":"OSV / GitHub Security Advisories","tags":["osv"],"url":"https://osv.dev/vulnerability/GHSA-v5fq-cf5m-vwv7"}],"remediation":[{"kind":"fix","source":"OSV GHSA-v5fq-cf5m-vwv7","text":"dolibarr/dolibarr (Packagist): OSV reports a fixed version 22.0.5. Check the advisory for supported release branches.","url":"https://github.com/advisories/GHSA-v5fq-cf5m-vwv7"},{"kind":"fix","source":"OSV GHSA-v5fq-cf5m-vwv7","text":"dolibarr/dolibarr (Packagist): OSV reports a fixed version 23.0.2. Check the advisory for supported release branches.","url":"https://github.com/advisories/GHSA-v5fq-cf5m-vwv7"}],"revision":"bf26064dd899e07541f8cec2a99f20054d613c9f9c6e53f74a6b33a1e198052a","sources":[{"modifiedAt":1793914903722,"name":"CNA: GitHub_M","retrievedAt":1793917107652,"url":"https://www.cve.org/CVERecord?id=CVE-2026-33944"},{"modifiedAt":1793916004132,"name":"OSV / GitHub Security Advisories","retrievedAt":1793917108323,"url":"https://osv.dev/vulnerability/GHSA-v5fq-cf5m-vwv7"}],"ssvc":null,"status":"published","title":"Dolibarr: SQL Injection in societe/class/societe.class.php via localtax1_value parameter","updatedAt":1793917108323}