https://db.gcve.eu/rss/recent/all/10 Most recent entries from all 2026-10-27T19:13:10.983518+00:00 Vulnerability-Lookup info@gcve.eu python-feedgen Contains only the most 10 recent entries. https://db.gcve.eu/vuln/cve-2026-116218 CVE-2026-116218 — Dolibarr ERP CRM 19.0.0 before 23.0.4 SQL Injection via bankaccounts API type field 2026-10-27T19:13:10.984735+00:00

Affected: dolibarr

Dolibarr ERP CRM 19.0.0 before 23.0.4 contains an SQL injection vulnerability that allows authenticated API users to inject SQL via the type field of the third-party bankaccounts REST endpoint. Attackers with only societe/creer permission can break out of the unescaped type value in CompanyBankAccount::create() to read password hashes and API keys via time-based blind subqueries.