CVE-2022-40871

9.8 criticalEPSS 35%

Critical (9.8) in dolibarr dolibarr erp\/crm. EPSS 35% chance of exploitation in the next 30 days.

Dolibarr ERP & CRM <=15.0.3 is vulnerable to Eval injection. By default, any administrator can be added to the installation page of dolibarr, and if successfully added, malicious code can be inserted into the database and then execute it by eval.

Severity

CVSS 3.1

9.8 critical

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS: 35% chance of exploitation in the next 30 days; higher than 98% of CVEs (scores of 2026-10-31)
CWE: CWE-94
Published: 2022-10-12
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

dolibarr:dolibarr_erp\/crm

References

https://github.com/youncyb/dolibarr-rce
https://github.com/youncyb/dolibarr-rce

Check your stack JSON