Web Application Vulnerabilities Runtime SCA Findings
Looking for the vulnerability index of Invicti's legacy products?
Invicti Enterprise Acunetix Standard & Premium
Dolibarr Improper Neutralization of Special Elements in Output Used by a Downstream Component (Injection) Vulnerability - CVE-2025-67486 - Vulnerability Database
Dolibarr

Dolibarr Improper Neutralization of Special Elements in Output Used by a Downstream Component (Injection) Vulnerability - CVE-2025-67486

High
Reference: CVE-2025-67486
NVD Link: https://nvd.nist.gov/vuln/detail/CVE-2025-67486
Title: Dolibarr Improper Neutralization of Special Elements in Output Used by a Downstream Component (Injection) Vulnerability
Overview:

Dolibarr is an enterprise resource planning (ERP) and customer relationship management (CRM) software package. Versions 22.0.2 and earlier contains an authenticated remote code execution vulnerability in the user extrafields functionality. User-controlled input from the quotcomputed valuequot field is passed to PHP39s eval() function without adequate sanitization allowing authenticated administrators to execute arbitrary PHP code on the server. As of time of publication no patched versions are available.