Advisories · Technology
SuiteCRM-Core.
Every CVE that names SuiteCRM-Core among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 6.5 Medium
SuiteCRM: RecordHandler::getRecord() missing ACLAccess('view') check allows any authenticated user to read any record (IDOR)
- SuiteCRM-Core
- Broken access control
- CVSS 8.6 High
SuiteCRM Authenticated Remote Code Execution via Unsafe Deserialization in SavedSearch Filter Processing
- SuiteCRM-Core
- Insecure deserialization
- CVSS 6.5 Medium
Authenticated SuiteCRM Users Can Retrieve The Password Hash of Any User
- SuiteCRM-Core
- Information disclosure
- CVSS 6.5 Medium
SuiteCRM is Vulnerable to Authenticated Blind SQL Injection via GraphQL
- SuiteCRM-Core
- SQL injection
- CVSS 8.8 High
SuiteCRM is Vulnerable to Authenticated Time Based Blind SQL Injection
- SuiteCRM-Core
- SQL injection
- CVSS 5.3 Medium
SuiteCRM: Legacy iCal service allows unauthenticated access to meeting data
- SuiteCRM-Core
- Information disclosure
- Broken access control