If you learned from my posts, inspired, or encouraged to grow in the cybersecurity and digital forensics, I would really appreciate your vote and support - Husam Shbib!
MyCyberNews

Search

Find merged stories by title or summary.

Vulnerabilities & Patches
Emerging1 src

CVE-2026-81728 - Dolibarr before 24.0.0 SQL Injection via the CSV and XLSX Import Update Keys

CVE ID : CVE-2026-81728 Published : Aug. 27, 2026, 8:18 p. m. • 55 minutes ago Description : Dolibarr before 24. 0. 0 contains a SQL injection in its CSV and XLSX import wizard. The wizard reads its update keys with GETPOST('updatekeys', 'array') in htdocs/imports/import. php, which applies only the generic alphanohtml filter: that strips HTML but leaves SQL keywords, comment markers, parentheses, spaces and quotes intact. import_insert() in htdocs/core/modules/import/import_csv. modules. php then iterates the submitted values and builds a filter with $where[] = $key.' = '. $data[$key], having first applied preg_replace('/^. *\. /i', '', $key), an alias strip that does nothing to a value containing no dot. The assembled string is executed through $this-db-query().

·CVEFeed
Read →
Vulnerabilities & Patches
Emerging1 src

cve-2026-81728

Dolibarr before 24. 0. 0 SQL Injection via the CSV and XLSX Import Update Keys

·CVE Program
Read →

You've reached the end of current stories for this search.