Doli-Secure (Check for vulnerabilities in Dolibarr)

DoliSecure

Automatically check that your installed Dolibarr version is not affected by any known vulnerability (CVE), using the public NVD (NIST) database. A home page indicator and an automatic email alert keep your administrators informed.

Module offered for free to the Dolibarr community.

Why DoliSecure?

An unpatched security flaw on your ERP can go unnoticed for months. Manually tracking Dolibarr security bulletins takes time and is easy to forget. DoliSecure automates this watch: it periodically queries the official NVD (National Vulnerability Database, NIST) for your installed version, shows the result directly inside Dolibarr, and notifies your administrators by email as soon as a vulnerability is published.

Key Features

Continuous monitoring (primary feature)

• Queries the public NVD (NIST) database — the official CVE vulnerability database, free and no API key required.
• Automatic check triggered whenever a Dolibarr page is loaded, without relying on the task scheduler (cron) working correctly.
• Configurable cache delay (in hours) to limit how often the NVD API is called.

Home page indicator

• Dedicated widget, with icon and color matching the severity level (critical, high, medium, low).
• Administrators only: other users see neither the widget nor the vulnerability details.
• Optional green banner to confirm no known vulnerability, even when everything is fine.

Alerts and detailed report

• Automatic email to administrators as soon as a new vulnerability is detected, sent only once as long as the list does not change.
• Customizable recipients, or automatic notification of all active users flagged as administrator.
• Detailed report page: CVE identifier, severity, fixed version (when known), publication date, direct link to the NVD page.

How It Works

1. Activate the DoliSecure module — the security widget appears automatically on the home page.
2. DoliSecure queries the NVD (NIST) database for your installed version, at most once per configured delay.
3. The result is shown as a color-coded indicator, visible to administrators only.
4. If a vulnerability is detected, an email is sent automatically to administrators.
5. Check the report page for the full detail of each CVE.

Set Up in Seconds

No API key, no external account to create: as soon as the module is activated, the check and the widget are up and running. You can then adjust the delay between two checks, enable the green confirmation banner, and choose the recipients of email alerts from the module's setup page.

Business Impact

• Works immediately after installation — no API key to configure.
• Proactive vulnerability detection, before an incident occurs.
• No more need to manually watch Dolibarr security bulletins.
• Strengthens the security credibility of your installation with clients and partners.
• Helps prioritize Dolibarr updates based on actual risk.

Included with the Module

• Download link for the installation package module_dolisecure-x.x.x.zip.
• Access to corrective maintenance.
• Free access to all future module updates.
• Free email support.

For help with the DoliSecure module, write to: dolibarr@joliciel.fr

Module Source Code

DoliSecure is open source. Its source code is freely available in the Dolibarr community modules repository: https://github.com/LaurentBouquet/dolibarr-community-modules/tree/dolisecure-module/dolisecure

Feel free to browse the code, report an issue, or suggest an improvement.

⚠️ Important Notice

NVD (NIST) database

• DoliSecure queries the public NVD API (services.nvd.nist.gov), free and no API key required.
• Only the installed Dolibarr version number is sent to this public service. No internal Dolibarr data (invoices, contacts, notes, etc.) is transmitted.

Widget and alerts

• The home page widget and its details are restricted to users flagged as administrator.
• Email alerts are sent to active administrators, or to the recipients you configure.

Module limitations

• DoliSecure detects and reports known vulnerabilities: it does not update Dolibarr automatically and does not fix any flaw by itself.
• The information shown depends on the data published by the NVD database at the time of the check.

Secure your Dolibarr installation today.
DoliSecure is available for free on DoliStore.