Tag feed

#pentesting

571 posts283 followers

Explore Hashnode

Alternatives

Trending tags this week

AJAmartya Jhasecurity-research.hashnode.dev3d ago · 4 min read

The Back-Office Break-In: Nine Dolibarr Findings

By CodeAnt AI · Security Research We went hunting for the security flaws that matter in the software real businesses run every day. In Dolibarr, the open-source ERP behind the invoices, payroll and b

0

AJAmartya Jhasecurity-research.hashnode.dev3d ago · 5 min read

CVE-2026-71511 · Read a member's card, receive their password hash

CVSS 6.5 · Sensitive data exposure (CWE-200) · Fixed in Dolibarr 24.0.0 Every reply is supposed to pass a redactor that blacks out secrets. The Users redactor blacks out the password. The Members reda

0

AJAmartya Jhasecurity-research.hashnode.dev3d ago · 6 min read

CVE-2026-71510 · Ask enough yes/no questions and you know everyone's salary

CVSS 6.5 · Authorization oracle → blind disclosure (CWE-863 / CWE-200) · Fixed in Dolibarr 24.0.0 You can't see the salary column, but the search box will happily answer “is this person's salary above

0

AJAmartya Jhasecurity-research.hashnode.dev3d ago · 5 min read

CVE-2026-71509 · Approve your own expenses — and your whole team's

CVSS 6.5 · Approval / access-control bypass (CWE-862) · Fixed in Dolibarr 24.0.0 The big “Approve” button correctly needs a manager. But the plain “edit this report” form lets you type approved and na

0

AJAmartya Jhasecurity-research.hashnode.dev3d ago · 5 min read

CVE-2026-71508 · Set your own salary — and the receipt hides it

CVSS 6.5 · Mass assignment on payroll fields (CWE-915) · Fixed in Dolibarr 24.0.0 The form that updates your profile refuses to let you change your job title, but leaves “salary” wide open, then shows

0

AJAmartya Jhasecurity-research.hashnode.dev3d ago · 6 min read

CVE-2026-71507 · Change one number, and the payroll run pays you

CVSS 6.5 · Object-level auth bypass → SEPA payment redirection (CWE-639) · Fixed in Dolibarr 24.0.0 You can't see a supplier's account, but you can quietly edit the bank number the company will pay. W

0

AJAmartya Jhasecurity-research.hashnode.dev3d ago · 5 min read

CVE-2026-71506 · The wrong key on the lock

CVSS 6.5 · Wrong-permission authorization (CWE-863) · Fixed in Dolibarr 24.0.0 The button labelled “delete a draft invoice” is wired to the vault that holds recorded payments. Press it and money that

0

AJAmartya Jhasecurity-research.hashnode.dev3d ago · 5 min read

CVE-2026-71505 · The read desk checks your ID. The write desk doesn't.

CVSS 8.1 · Broken object-level authorization (CWE-639) · Fixed in Dolibarr 24.0.0 The clerk who shows you a file first checks it's yours. The clerk who resets the password on that file never checks, s

0

AJAmartya Jhasecurity-research.hashnode.dev3d ago · 6 min read

CVE-2026-71504 · The membership desk that could reset the admin's password

CVSS 8.3 · Mass assignment (CWE-915) · Fixed in Dolibarr 24.0.0 The front desk refuses to change the CEO's password. But the membership clerk's window, which nobody thought to lock will happily do it,

0

AJAmartya Jhasecurity-research.hashnode.dev3d ago · 7 min read

CVE-2026-71503 · One link, opened once, mints a second admin

CVSS 9.3 · Reflected XSS (CWE-79), chained to admin creation · Fixed in Dolibarr 24.0.0 Think of a contractor's badge that, when scanned at reception, silently prints a second master key, and the guar

0

#pentesting

Search Hashnode

#pentesting

Explore Hashnode

Trending tags this week

The Back-Office Break-In: Nine Dolibarr Findings

CVE-2026-71511 · Read a member's card, receive their password hash

CVE-2026-71510 · Ask enough yes/no questions and you know everyone's salary

CVE-2026-71509 · Approve your own expenses — and your whole team's

CVE-2026-71508 · Set your own salary — and the receipt hides it

CVE-2026-71507 · Change one number, and the payroll run pays you

CVE-2026-71506 · The wrong key on the lock

CVE-2026-71505 · The read desk checks your ID. The write desk doesn't.

CVE-2026-71504 · The membership desk that could reset the admin's password

CVE-2026-71503 · One link, opened once, mints a second admin