CVE-2018-10092

The admin panel in Dolibarr before 7.0.2 might allow remote attackers to execute arbitrary commands by leveraging support for updating the antivirus command and parameters used to scan file uploads.

• CWE-862

• http://www.openwall.com/lists/oss-security/2018/05/21/2Exploit, Mailing List, Technical Description, Third Party Advisory
• https://github.com/Dolibarr/dolibarr/blob/7.0.2/ChangeLogRelease Notes
• https://github.com/Dolibarr/dolibarr/commit/5d121b2d3ae2a95abebc9dc31e4782cbc61a1f39Patch
• https://sysdream.com/news/lab/2018-05-21-cve-2018-10092-dolibarr-admin-panel-authenticated-remote-code-execution-rce-vulnerability/Exploit, Technical Description, Third Party Advisory
• http://www.openwall.com/lists/oss-security/2018/05/21/2Exploit, Mailing List, Technical Description, Third Party Advisory
• https://github.com/Dolibarr/dolibarr/blob/7.0.2/ChangeLogRelease Notes
• https://github.com/Dolibarr/dolibarr/commit/5d121b2d3ae2a95abebc9dc31e4782cbc61a1f39Patch
• https://sysdream.com/news/lab/2018-05-21-cve-2018-10092-dolibarr-admin-panel-authenticated-remote-code-execution-rce-vulnerability/Exploit, Technical Description, Third Party Advisory

Published

May 22, 2018

Last Modified

Jun 17, 2026

Status

Modified

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2018-10085CMS Made Simple (CMSMS) through 2.2.6 allows PHP object inje…
• CVE-2018-10086CMS Made Simple (CMSMS) through 2.2.7 contains an arbitrary …
• CVE-2018-10087The kernel_wait4 function in kernel/exit.c in the Linux kern…
• CVE-2018-10088Buffer overflow in XiongMai uc-httpd 1.0.0 has unspecified i…
• CVE-2018-1009An elevation of privilege vulnerability exists when Windows …
• CVE-2018-10091AudioCodes IP phone 420HD devices using firmware version 2.2…
• CVE-2018-10093AudioCodes IP phone 420HD devices using firmware version 2.2…
• CVE-2018-10094SQL injection vulnerability in Dolibarr before 7.0.2 allows …
• CVE-2018-10095Cross-site scripting (XSS) vulnerability in Dolibarr before …
• CVE-2018-10096joyplus-cms 1.6.0 has XSS via the device_name parameter in a…
• CVE-2018-10097XSS exists in Domain Trader 2.5.3 via the recoverlogin.php e…
• CVE-2018-10098In MicroWorld eScan Internet Security Suite (ISS) for Busine…