Advisories · Technology

salesagility SuiteCRM.

Every CVE that names salesagility SuiteCRM among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.

CVE-2024-50335 CVE record

CVSS 4.9 Medium

Authenticated XSS in "Publish Key" Field Allowing Unauthorized Administrator User Creation in SuiteCRM
- salesagility SuiteCRM
- Cross-site scripting (XSS)
Not analysed yet 5 Nov 2024
CVE-2024-50333 CVE record

CVSS 6.6 Medium

RCE in ModuleBuilder in SuiteCRM
- salesagility SuiteCRM
- CWE-20
Not analysed yet 5 Nov 2024
CVE-2024-50332 CVE record

CVSS 8.8 High

Authenticated Blind SQL Injection in DeleteRelationShip in SuiteCRM
- salesagility SuiteCRM
- SQL injection
Not analysed yet 5 Nov 2024
CVE-2024-49774 CVE record

CVSS 7.2 High

ModuleScanner flaws in SuiteCRM
- salesagility SuiteCRM
- CWE-20
Not analysed yet 5 Nov 2024
CVE-2024-49773 CVE record

CVSS 5.3 Medium

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in SuiteCRM
- salesagility SuiteCRM
- SQL injection
Not analysed yet 5 Nov 2024
CVE-2024-49772 CVE record

CVSS 8.8 High

Authenticated SQL injection in AM_ProjectTemplates controller in SuiteCRM
- salesagility SuiteCRM
- SQL injection
Not analysed yet 5 Nov 2024
CVE-2024-45392 CVE record

CVSS 7.7 High

SuiteCRM has wrong deletion permission checks on API delete call
- salesagility SuiteCRM
- Broken access control
Not analysed yet 5 Sept 2024
CVE-2024-36418 CVE record

CVSS 8.6 High

SuiteCRM authenticated RCE using connectors
- salesagility SuiteCRM
- Path traversal
Not analysed yet 10 Jun 2024
CVE-2024-36416 CVE record

CVSS 8.6 High

SuiteCRM v4 API Excessive log data DOS
- salesagility SuiteCRM
- CWE-779
Not analysed yet 10 Jun 2024
CVE-2024-36417 CVE record

CVSS 5.7 Medium

SuiteCRM Stored XSS Vulnerability Allows Code Execution via Malicious iFrame
- salesagility SuiteCRM
- Cross-site scripting (XSS)
Not analysed yet 10 Jun 2024
CVE-2024-36415 CVE record

CVSS 9.1 CriticalCritical · CVSS 9+

SuiteCRM Improper Control of Filename for Include Statement in PHP and Unrestricted Upload of File with Dangerous content leads to authenticated remote code execution
- salesagility SuiteCRM
- File inclusion
- Unrestricted file upload
Not analysed yet 10 Jun 2024
CVE-2024-36414 CVE record

CVSS 7.7 High

SuiteCRM authenticated Server-Side Request Forgery
- salesagility SuiteCRM
- Server-side request forgery (SSRF)
Not analysed yet 10 Jun 2024
CVE-2024-36413 CVE record

CVSS 8.9 High

SuiteCRM authenticated Reflected Cross-Site Scripting
- salesagility SuiteCRM
- Cross-site scripting (XSS)
Not analysed yet 10 Jun 2024
CVE-2024-36412 CVE record

CVSS 10.0 CriticalCritical · CVSS 9+

SuiteCRM unauthenticated SQL Injection
- salesagility SuiteCRM
- SQL injection
Not analysed yet 10 Jun 2024
CVE-2024-36411 CVE record

CVSS 9.6 CriticalCritical · CVSS 9+

SuiteCRM authenticated SQL Injection in EmailUIAjax displayView controller
- salesagility SuiteCRM
- SQL injection
Not analysed yet 10 Jun 2024
CVE-2024-36410 CVE record

CVSS 9.6 CriticalCritical · CVSS 9+

SuiteCRM authenticated SQL Injection in EmailUIAjax messages count controller
- salesagility SuiteCRM
- SQL injection
Not analysed yet 10 Jun 2024
CVE-2024-36409 CVE record

CVSS 9.6 CriticalCritical · CVSS 9+

SuiteCRM authenticated SQL Injection in TreeData entrypoint
- salesagility SuiteCRM
- SQL injection
Not analysed yet 10 Jun 2024
CVE-2024-36408 CVE record

CVSS 9.6 CriticalCritical · CVSS 9+

SuiteCRM authenticated SQL Injection in Alerts
- salesagility SuiteCRM
- SQL injection
Not analysed yet 10 Jun 2024
CVE-2024-36407 CVE record

CVSS 3.7 Low

SuiteCRM unauthenticated user password reset on php7
- salesagility SuiteCRM
- CWE-640
Not analysed yet 10 Jun 2024
CVE-2024-36406 CVE record

CVSS 5.4 Medium

SuiteCRM vulnerable to open redirects
- salesagility SuiteCRM
- Open redirect
Not analysed yet 10 Jun 2024
CVE-2023-6131 CVE record

CVSS 7.2 High

Code Injection in salesagility/suitecrm
- salesagility/suitecrm
- Code injection
Not analysed yet 14 Nov 2023
CVE-2023-6130 CVE record

CVSS 7.5 High

Path Traversal: '\..\filename' in salesagility/suitecrm
- salesagility/suitecrm
- CWE-29
Not analysed yet 14 Nov 2023
CVE-2023-6128 CVE record

CVSS 6.8 Medium

Cross-site Scripting (XSS) - Reflected in salesagility/suitecrm
- salesagility/suitecrm
- Cross-site scripting (XSS)
Not analysed yet 14 Nov 2023
CVE-2023-6127 CVE record

CVSS 5.4 Medium

Unrestricted Upload of File with Dangerous Type in salesagility/suitecrm
- salesagility/suitecrm
- Unrestricted file upload
Not analysed yet 14 Nov 2023
CVE-2023-6126 CVE record

CVSS 4.3 Medium

Code Injection in salesagility/suitecrm
- salesagility/suitecrm
- Code injection
Not analysed yet 14 Nov 2023
CVE-2023-6125 CVE record

CVSS 5.4 Medium

Code Injection in salesagility/suitecrm
- salesagility/suitecrm
- Code injection
Not analysed yet 14 Nov 2023
CVE-2023-6124 CVE record

CVSS 5.0 Medium

Server-Side Request Forgery (SSRF) in salesagility/suitecrm
- salesagility/suitecrm
- Server-side request forgery (SSRF)
Not analysed yet 14 Nov 2023
CVE-2023-5353 CVE record

CVSS 8.1 High

Improper Access Control in salesagility/suitecrm
- salesagility/suitecrm
- Broken access control
Not analysed yet 3 Oct 2023
CVE-2023-5351 CVE record

CVSS 8.9 High

Cross-site Scripting (XSS) - Stored in salesagility/suitecrm
- salesagility/suitecrm
- Cross-site scripting (XSS)
Not analysed yet 3 Oct 2023
CVE-2023-5350 CVE record

CVSS 6.4 Medium

SQL Injection in salesagility/suitecrm
- salesagility/suitecrm
- SQL injection
Not analysed yet 3 Oct 2023
CVE-2023-1034 CVE record

CVSS 4.3 Medium

Path Traversal: '\..\filename' in salesagility/suitecrm
- salesagility/suitecrm
- CWE-29
Not analysed yet 25 Feb 2023
CVE-2022-0754 CVE record

CVSS 7.1 High

SQL Injection in salesagility/suitecrm
- salesagility/suitecrm
- SQL injection
Not analysed yet 7 Mar 2022
CVE-2022-0756 CVE record

CVSS 5.4 Medium

Missing Authorization in salesagility/suitecrm
- salesagility/suitecrm
- Broken access control
Not analysed yet 7 Mar 2022
CVE-2022-0755 CVE record

CVSS 7.1 High

Missing Authorization in salesagility/suitecrm
- salesagility/suitecrm
- Broken access control
Not analysed yet 7 Mar 2022
CVE-2021-25960 CVE record

CVSS 8.0 High

SuiteCRM - CSV Injection in Accounts Module
- salesagility SuiteCRM
- Other injection
Not analysed yet 29 Sept 2021
CVE-2021-25961 CVE record

CVSS 8.0 High

SuiteCRM - Account Takeover in Password Reset Functionality
- salesagility SuiteCRM
- CWE-640
Not analysed yet 29 Sept 2021