Advisories · Technology
SuiteCRM.
Every CVE that names SuiteCRM among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 9.4 CriticalCritical · CVSS 9+
SuiteCRM: Admin OS RCE via Dropdown Editor PHP Injection
- SuiteCRM
- Code injection
- CVSS 8.8 High
SuiteCRM: Privilege escalation via V8 REST modules (ACLRoles, ACLActions, Administration)
- SuiteCRM
- Privilege escalation
- CVSS 6.5 Medium
SuiteCRM: Authenticated SQL Injection In action_get_end_date function
- SuiteCRM
- SQL injection
- CVSS 6.9 Medium
SuiteCRM: V8 OAuth2 Username Enumeration
- SuiteCRM
- CWE-204
- CVSS 8.8 High
SuiteCRM: Authenticated SQL Injection in SOAP Portal Method portal_get_entry_list
- SuiteCRM
- SQL injection
- CVSS 7.1 High
SuiteCRM: V8 API Relationship Delete Bypasses Object-Level Authorization on the Related Record
- SuiteCRM
- Broken access control
- CVSS 7.1 High
SuiteCRM: Mass Assignment in V8 API Allows Modification of Sensitive User Fields (user_hash, external_auth_only)
- SuiteCRM
- Broken access control
- CVSS 7.1 High
SuiteCRM V8 JSON:API processAttributes() Missing ID Filter Allows ACL Bypass and Record Ownership Hijack
- SuiteCRM
- Broken access control
- CVSS 8.8 High
SuiteCRM: Time-Based Blind SQL Injection via AOR_Reports ORDER BY Clause Allows Data Exfiltration by Any Authenticated User
- SuiteCRM
- SQL injection
- Other injection
- CVSS 8.8 High
SuiteCRM: Authenticated SQL Injection in AOR_Reports `parameter_value` (value_type=Field) allows any low-privileged user to read the full database
- SuiteCRM
- SQL injection
- CWE-20
- CVSS 9.9 CriticalCritical · CVSS 9+
SuiteCRM: LFI to RCE via AOW_WorkFlow
- SuiteCRM
- File inclusion
- CVSS 8.8 High
SuiteCRM: SQL Injection via REST API securexss() Bypass in Relationship Management
- SuiteCRM
- SQL injection
- CVSS 8.3 High
SuiteCRM: SQL injection via search param in modules/Cases/controller.php
- SuiteCRM
- SQL injection
- CVSS 8.8 High
SuiteCRM: Authenticated SQL Injection in map_markers distance Parameter
- SuiteCRM
- SQL injection
- CVSS 8.3 High
SuiteCRM: SQL injection via get_latest_for_id param in GetLatestRevision.php
- SuiteCRM
- SQL injection
- CVSS 6.5 Medium
SuiteCRM: AOR Reports aor_fields.field SQL Injection
- SuiteCRM
- SQL injection
- CVSS 7.1 High
SuiteCRM: Authenticated SQL Injection In handleAttachments function
- SuiteCRM
- SQL injection
- CVSS 7.1 High
SuiteCRM: Authenticated SQL Injection In Project Module
- SuiteCRM
- SQL injection
- CVSS 6.5 Medium
SuiteCRM: Authorization Bypass via Document Revision ID Confusion in download.php
- SuiteCRM
- Broken access control
- CVSS 7.7 High
SuiteCRM: Authenticated SSRF in CalendarAccount testConnection Allows Internal Network Access and Response Disclosure
- SuiteCRM
- Server-side request forgery (SSRF)
- CVSS 8.3 High
SuiteCRM: SQL injection via parameter_value[0] param in AOR_Report.php
- SuiteCRM
- SQL injection
- CVSS 8.1 High
SuiteCRM: Incorrect Access Control in V8 relationship creation via missing edit authorization
- SuiteCRM
- Broken access control
- CVSS 8.3 High
SuiteCRM: SQL injection via id param in modules/Campaigns/PopupCampaignRoi.php
- SuiteCRM
- SQL injection
- CVSS 7.2 High
SuiteCRM: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in SuiteCRM
- SuiteCRM
- Path traversal
- CVSS 7.7 High
SuiteCRM: isSelfRequest() bypass via substring match allows SSRF to internal services
- SuiteCRM
- Server-side request forgery (SSRF)
- CVSS 8.3 High
SuiteCRM: Time-Based Blind SQL Injection via REST API
- SuiteCRM
- SQL injection
- CVSS 6.5 Medium
SuiteCRM: IDOR in generatePdf Entry Point Allows Record Data Exfiltration
- SuiteCRM
- Broken access control
- CVSS 8.8 High
SuiteCRM: Authenticated SQL Injection in v4_1 get_entry_list rest api
- SuiteCRM
- SQL injection
- Other injection
- CVSS 6.5 Medium
SuiteCRM: Record-level Authorization Bypass via AOR_Reports changeReportPage
- SuiteCRM
- Broken access control
- CVSS 8.3 High
SuiteCRM: Authenticated SQL Injection in get_end_date function in Project Controller
- SuiteCRM
- SQL injection
- CVSS 7.1 High
SuiteCRM: Non-admin user creates SchedulersJob: SSRF via cron
- SuiteCRM
- Broken access control
- Server-side request forgery (SSRF)
- CVSS 5.3 Medium
SuiteCRM through 7.15.2 and 8.10.2 Missing Authorization via setCampaignMarketingAndTemplate
- SuiteCRM
- Broken access control
- CVSS 5.3 Medium
SuiteCRM through 7.15.2 and 8.10.2 Missing Authorization via DetailUserRole Entry Point
- SuiteCRM
- Broken access control
- CVSS 7.1 High
SuiteCRM 7.10.7 SQL Injection via record Parameter
- SuiteCRM
- SQL injection
- CVSS 7.1 High
SuiteCRM 7.10.7 SQL Injection via parentTab Parameter
- SuiteCRM
- SQL injection
- CVSS 8.8 High
SuiterCRM has LDAP Filter Injection in Authentication Module
- SuiteCRM
- Other injection
- CVSS 8.8 High
SuiteCRM has Authenticated SQL Injection in Authentication Module
- SuiteCRM
- SQL injection
- CVSS 8.1 High
SuiteCRM has a REST API V8 IDOR: Missing ACL Checks on User Preferences and Relationship Endpoints
- SuiteCRM
- Broken access control
- CVSS 5.0 Medium
SuiteCRM vulnerable to authenticated SSRF via PDF export
- SuiteCRM
- Server-side request forgery (SSRF)
- CVSS 5.9 Medium
SuiteCRM has blind XSS in return_id parameter
- SuiteCRM
- Cross-site scripting (XSS)
- CWE-116
- CVSS 5.4 Medium
SuiteCRM has Unauthenticated Open Redirect in Leads WebToLead Capture
- SuiteCRM
- Open redirect
- CVSS 2.7 Low
SuiteCRM Vulnerable to Authenticated Arbitrary File Upload via Configurator addfontresult View in SuiteCRM
- SuiteCRM
- Unrestricted file upload
- CVSS 9.1 CriticalCritical · CVSS 9+
SuiteCRM Vulnerable to Remote Code Execution via Module Loader Package Scanner Bypass
- SuiteCRM
- Code injection
- CWE-358
- CVSS 7.2 High
SuiteCRM has Authenticated RCE in Modules
- SuiteCRM
- Code injection
- CVSS 4.9 Medium
SuiteCRM Vulnerable to Directory Traversal to DoS in Modules
- SuiteCRM
- Path traversal
- CVSS 7.1 High
SuiteCRM has Reflected HTML Injection in Login Page via default_user_name Parameter
- SuiteCRM
- Cross-site scripting (XSS)
- CVSS 8.8 High
SuiteCRM has Authenticated Blind SQL Injection in OutboundEmail Legacy Functionality.
- SuiteCRM
- SQL injection
- CVSS 4.9 Medium
SuiteCRM has Relative Path Traversal via ModuleBuilder Modules ExportCustom Action
- SuiteCRM
- Path traversal
- CVSS 7.1 High
SuiteCRM Server-Side Request Forgery and Denial of Service via RSS Feed Dashlet
- SuiteCRM
- Server-side request forgery (SSRF)
- CVSS 8.1 High
SuiteCRM vulnerable to Authenticated SQL Injection via unsanitized field_function in Report Fields
- SuiteCRM
- SQL injection
- CVSS 6.1 Medium
SuiteCRM is vulnerable to unauthenticated reflected XSS through its Login page
- SuiteCRM
- Cross-site scripting (XSS)
- CVSS 8.3 High
SuiteCRM's Inconsistent RBAC Enforcement Enables Access Control Bypass
- SuiteCRM
- Broken access control
- CVSS 8.3 High
SuiteCRM: Privilege Escalation via Improper Session Invalidation and Inactive User Bypass
- SuiteCRM
- Privilege escalation
- CVSS 8.6 High
SuiteCRM: Authenticated SQL Injection Possible in Reschedule Call Module
- SuiteCRM
- SQL injection
- CVSS 8.8 High
SuiteCRM < 7.12.6 Type Confusion via 'deleteAttachment' Functionality
- SuiteCRM
- Memory corruption
- CVSS 9.3 CriticalCritical · CVSS 9+
SuiteCRM < 7.12.6 SQL Injection via 'export' Functionality
- SuiteCRM
- SQL injection
- CVSS 5.1 Medium
Reflected Cross-Site Scripting (XSS) in SuiteCRM
- SuiteCRM
- Cross-site scripting (XSS)
- CVSS 3.7 Low
SuiteCRM: Improper Authorization for attachment downloads
- SuiteCRM
- Broken access control
- CVSS 8.6 High
SuiteCRM is vulnerable to Cross Site Scripting (XSS) through its email viewer
- SuiteCRM
- Cross-site scripting (XSS)
- CVSS 5.1 Medium
SuiteCRM: Reflected Cross Site Scripting (XSS) through HTTP Referrer header
- SuiteCRM
- Cross-site scripting (XSS)