Open-source business platforms

Across eighteen platforms, 14,647,101 European websites were detected running one of them. That counts websites rather than companies, the provider’s definition of Europe is wider than the EU27, and WordPress’s share includes personal sites.

It is also the floor, not the ceiling. Two of the eighteen have no defensible public count at all — Dolibarr and metasfresh are business systems behind a login, so there is nothing public to detect. ERPNext shows 39 and SuiteCRM 402, which are visible samples rather than adoption figures, while Dolibarr’s own maintainers estimate 200,000 organisations worldwide.

So the platforms a company runs its operations on are precisely the ones this method cannot see. The website numbers are large; the invisible population is the one that holds the invoices.

Adding a single country restriction narrows either query to one market. That is the whole technique, and it is in every search-operator tutorial — which is the point: this is not a capability anybody has to acquire.

What this does not show is a vulnerable version. A footer or a login page says a product is running, not which release — and we publish neither credentials, exports nor exploit paths. Testing anything you do not own needs permission.

Eighteen products publish security news in 13 different ways. Core and plugins are separate sources for some; others route through a parent vendor; one maintainer states plainly that they are not a CVE Numbering Authority and do not publish CVE reports themselves; another had no product-specific CVE at all when we looked.

A company running five of these has five habits to maintain, in five formats, with no common schedule. That is not a discipline problem. There is no single place to watch.

And a growing share of fixes carry no CVE at all. Shopware's most recent critical releases were published as repository advisories without one; ERPNext disclosed sixty-eight in eight weeks, almost none with a CVE; eleven of sixteen recent WordPress core advisories had none. So watching CVE feeds alone — the obvious thing to automate — misses them.

Two things this table is not. More published vulnerabilities does not mean a less secure product — it often means a more organised disclosure process. And an empty advisory feed is not evidence a product is untracked; Odoo publishes through its own channel while its repository advisory list was empty when we checked.

Platform counts retrieved 2026-10-03 from BuiltWith. Advisory practices checked the same week, and re-verified first-hand on 2026-10-04 against the live advisory data. Both change; the figures here are a measurement with a date on it, not a standing fact.