Veille CVE

Vendredi 11 septembre 2026

1 CVE sur 2

Critique 0 Élevée 1 Moyenne 1 Faible 0 Non évaluée 0 Exploitées (KEV) Tri : plus récentes « dolibarr » ✕
  1. CVE-2026-89012 6.5 Moyenne

    Dolibarr

    Dolibarr 24.0.0 before 24.0.1 contains a case-sensitive denylist bypass vulnerability in the sqlfilters API query parameter that allows authenticated attackers to recover protected database fields by supplying uppercase variants of denylist-protected field names. Attackers can exploit the case-insensitive database column resolution against the case-sensitive denylist check in the core library to use prefix-matching predicates as a boolean oracle and extract full password hashes for any user account, including administrators.