agentprime: suitecrm

agentprime: suitecrmEvery new CVE for suitecrm.https://agentprime.io/CVE-2026-100358: SuiteCRM: Admin OS RCE via Dropdown Editor PHP Injectionhttps://agentprime.io/advisories/CVE-2026-100358/https://agentprime.io/advisories/CVE-2026-100358/CVSS 9.4 (Critical). Critical: CVSS score 9.4: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Thu, 05 Nov 2026 18:47:59 GMTCVEcriticalCVE-2026-100363: SuiteCRM: Privilege escalation via V8 REST modules (ACLRoles, ACLActions, Administration)https://agentprime.io/advisories/CVE-2026-100363/https://agentprime.io/advisories/CVE-2026-100363/CVSS 8.8 (High). Published by the CVE Program. Not analysed by agentprime yet.Thu, 05 Nov 2026 18:47:05 GMTCVECVE-2026-100359: SuiteCRM: Authenticated SQL Injection In action_get_end_date functionhttps://agentprime.io/advisories/CVE-2026-100359/https://agentprime.io/advisories/CVE-2026-100359/CVSS 6.5 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Thu, 05 Nov 2026 18:45:59 GMTCVECVE-2026-100362: SuiteCRM: V8 OAuth2 Username Enumerationhttps://agentprime.io/advisories/CVE-2026-100362/https://agentprime.io/advisories/CVE-2026-100362/CVSS 6.9 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Thu, 05 Nov 2026 18:44:59 GMTCVECVE-2026-97377: SuiteCRM: Authenticated SQL Injection in SOAP Portal Method portal_get_entry_listhttps://agentprime.io/advisories/CVE-2026-97377/https://agentprime.io/advisories/CVE-2026-97377/CVSS 8.8 (High). Published by the CVE Program. Not analysed by agentprime yet.Thu, 05 Nov 2026 18:42:28 GMTCVECVE-2026-100360: SuiteCRM: V8 API Relationship Delete Bypasses Object-Level Authorization on the Related Recordhttps://agentprime.io/advisories/CVE-2026-100360/https://agentprime.io/advisories/CVE-2026-100360/CVSS 7.1 (High). Published by the CVE Program. Not analysed by agentprime yet.Thu, 05 Nov 2026 18:41:33 GMTCVECVE-2026-100361: SuiteCRM: Mass Assignment in V8 API Allows Modification of Sensitive User Fields (user_hash, external_auth_only)https://agentprime.io/advisories/CVE-2026-100361/https://agentprime.io/advisories/CVE-2026-100361/CVSS 7.1 (High). Published by the CVE Program. Not analysed by agentprime yet.Thu, 05 Nov 2026 18:40:35 GMTCVECVE-2026-100364: SuiteCRM V8 JSON:API processAttributes() Missing ID Filter Allows ACL Bypass and Record Ownership Hijackhttps://agentprime.io/advisories/CVE-2026-100364/https://agentprime.io/advisories/CVE-2026-100364/CVSS 7.1 (High). Published by the CVE Program. Not analysed by agentprime yet.Thu, 05 Nov 2026 18:39:41 GMTCVECVE-2026-100365: SuiteCRM: Time-Based Blind SQL Injection via AOR_Reports ORDER BY Clause Allows Data Exfiltration by Any Authenticated Userhttps://agentprime.io/advisories/CVE-2026-100365/https://agentprime.io/advisories/CVE-2026-100365/CVSS 8.8 (High). Published by the CVE Program. Not analysed by agentprime yet.Thu, 05 Nov 2026 18:38:37 GMTCVECVE-2026-71548: SuiteCRM: Authenticated SQL Injection in AOR_Reports `parameter_value` (value_type=Field) allows any low-privileged user to read the full databasehttps://agentprime.io/advisories/CVE-2026-71548/https://agentprime.io/advisories/CVE-2026-71548/CVSS 8.8 (High). Published by the CVE Program. Not analysed by agentprime yet.Thu, 05 Nov 2026 18:37:44 GMTCVECVE-2026-71550: SuiteCRM: LFI to RCE via AOW_WorkFlowhttps://agentprime.io/advisories/CVE-2026-71550/https://agentprime.io/advisories/CVE-2026-71550/CVSS 9.9 (Critical). Critical: CVSS score 9.9: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Thu, 05 Nov 2026 18:36:47 GMTCVEcriticalCVE-2026-69134: SuiteCRM: SQL Injection via REST API securexss() Bypass in Relationship Managementhttps://agentprime.io/advisories/CVE-2026-69134/https://agentprime.io/advisories/CVE-2026-69134/CVSS 8.8 (High). Published by the CVE Program. Not analysed by agentprime yet.Thu, 05 Nov 2026 18:35:49 GMTCVECVE-2026-69141: SuiteCRM: SQL injection via search param in modules/Cases/controller.phphttps://agentprime.io/advisories/CVE-2026-69141/https://agentprime.io/advisories/CVE-2026-69141/CVSS 8.3 (High). Published by the CVE Program. Not analysed by agentprime yet.Thu, 05 Nov 2026 18:28:17 GMTCVECVE-2026-69142: SuiteCRM: Authenticated SQL Injection in map_markers distance Parameterhttps://agentprime.io/advisories/CVE-2026-69142/https://agentprime.io/advisories/CVE-2026-69142/CVSS 8.8 (High). Published by the CVE Program. Not analysed by agentprime yet.Thu, 05 Nov 2026 18:27:10 GMTCVECVE-2026-69140: SuiteCRM: SQL injection via get_latest_for_id param in GetLatestRevision.phphttps://agentprime.io/advisories/CVE-2026-69140/https://agentprime.io/advisories/CVE-2026-69140/CVSS 8.3 (High). Published by the CVE Program. Not analysed by agentprime yet.Thu, 05 Nov 2026 18:26:12 GMTCVECVE-2026-69145: SuiteCRM: AOR Reports aor_fields.field SQL Injectionhttps://agentprime.io/advisories/CVE-2026-69145/https://agentprime.io/advisories/CVE-2026-69145/CVSS 6.5 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Thu, 05 Nov 2026 18:25:08 GMTCVECVE-2026-69136: SuiteCRM: Authenticated SQL Injection In handleAttachments functionhttps://agentprime.io/advisories/CVE-2026-69136/https://agentprime.io/advisories/CVE-2026-69136/CVSS 7.1 (High). Published by the CVE Program. Not analysed by agentprime yet.Thu, 05 Nov 2026 18:24:12 GMTCVECVE-2026-69135: SuiteCRM: Authenticated SQL Injection In Project Modulehttps://agentprime.io/advisories/CVE-2026-69135/https://agentprime.io/advisories/CVE-2026-69135/CVSS 7.1 (High). Published by the CVE Program. Not analysed by agentprime yet.Thu, 05 Nov 2026 18:23:15 GMTCVECVE-2026-69144: SuiteCRM: Authorization Bypass via Document Revision ID Confusion in download.phphttps://agentprime.io/advisories/CVE-2026-69144/https://agentprime.io/advisories/CVE-2026-69144/CVSS 6.5 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Thu, 05 Nov 2026 18:22:20 GMTCVECVE-2026-69137: SuiteCRM: Authenticated SSRF in CalendarAccount testConnection Allows Internal Network Access and Response Disclosurehttps://agentprime.io/advisories/CVE-2026-69137/https://agentprime.io/advisories/CVE-2026-69137/CVSS 7.7 (High). Published by the CVE Program. Not analysed by agentprime yet.Thu, 05 Nov 2026 18:21:17 GMTCVECVE-2026-61648: SuiteCRM: SQL injection via parameter_value[0] param in AOR_Report.phphttps://agentprime.io/advisories/CVE-2026-61648/https://agentprime.io/advisories/CVE-2026-61648/CVSS 8.3 (High). Published by the CVE Program. Not analysed by agentprime yet.Thu, 05 Nov 2026 18:20:22 GMTCVECVE-2026-61650: SuiteCRM: Incorrect Access Control in V8 relationship creation via missing edit authorizationhttps://agentprime.io/advisories/CVE-2026-61650/https://agentprime.io/advisories/CVE-2026-61650/CVSS 8.1 (High). Published by the CVE Program. Not analysed by agentprime yet.Thu, 05 Nov 2026 18:19:14 GMTCVECVE-2026-61653: SuiteCRM: SQL injection via id param in modules/Campaigns/PopupCampaignRoi.phphttps://agentprime.io/advisories/CVE-2026-61653/https://agentprime.io/advisories/CVE-2026-61653/CVSS 8.3 (High). Published by the CVE Program. Not analysed by agentprime yet.Thu, 05 Nov 2026 18:18:13 GMTCVECVE-2026-63213: SuiteCRM: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in SuiteCRMhttps://agentprime.io/advisories/CVE-2026-63213/https://agentprime.io/advisories/CVE-2026-63213/CVSS 7.2 (High). Published by the CVE Program. Not analysed by agentprime yet.Thu, 05 Nov 2026 18:17:00 GMTCVECVE-2026-61649: SuiteCRM: isSelfRequest() bypass via substring match allows SSRF to internal serviceshttps://agentprime.io/advisories/CVE-2026-61649/https://agentprime.io/advisories/CVE-2026-61649/CVSS 7.7 (High). Published by the CVE Program. Not analysed by agentprime yet.Thu, 05 Nov 2026 18:15:54 GMTCVECVE-2026-63215: SuiteCRM: Time-Based Blind SQL Injection via REST APIhttps://agentprime.io/advisories/CVE-2026-63215/https://agentprime.io/advisories/CVE-2026-63215/CVSS 8.3 (High). Published by the CVE Program. Not analysed by agentprime yet.Thu, 05 Nov 2026 18:14:52 GMTCVECVE-2026-63217: SuiteCRM: IDOR in generatePdf Entry Point Allows Record Data Exfiltrationhttps://agentprime.io/advisories/CVE-2026-63217/https://agentprime.io/advisories/CVE-2026-63217/CVSS 6.5 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Thu, 05 Nov 2026 18:13:19 GMTCVECVE-2026-63214: SuiteCRM: Authenticated SQL Injection in v4_1 get_entry_list rest apihttps://agentprime.io/advisories/CVE-2026-63214/https://agentprime.io/advisories/CVE-2026-63214/CVSS 8.8 (High). Published by the CVE Program. Not analysed by agentprime yet.Thu, 05 Nov 2026 18:12:25 GMTCVECVE-2026-63218: SuiteCRM: Record-level Authorization Bypass via AOR_Reports changeReportPagehttps://agentprime.io/advisories/CVE-2026-63218/https://agentprime.io/advisories/CVE-2026-63218/CVSS 6.5 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Thu, 05 Nov 2026 18:11:30 GMTCVECVE-2026-61651: SuiteCRM: Authenticated SQL Injection in get_end_date function in Project Controllerhttps://agentprime.io/advisories/CVE-2026-61651/https://agentprime.io/advisories/CVE-2026-61651/CVSS 8.3 (High). Published by the CVE Program. Not analysed by agentprime yet.Thu, 05 Nov 2026 18:10:35 GMTCVECVE-2026-63111: SuiteCRM: Non-admin user creates SchedulersJob: SSRF via cronhttps://agentprime.io/advisories/CVE-2026-63111/https://agentprime.io/advisories/CVE-2026-63111/CVSS 7.1 (High). Published by the CVE Program. Not analysed by agentprime yet.Thu, 05 Nov 2026 18:09:36 GMTCVECVE-2026-108713: SuiteCRM through 7.15.2 and 8.10.2 Missing Authorization via setCampaignMarketingAndTemplatehttps://agentprime.io/advisories/CVE-2026-108713/https://agentprime.io/advisories/CVE-2026-108713/CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Sun, 11 Oct 2026 12:19:26 GMTCVECVE-2026-108712: SuiteCRM through 7.15.2 and 8.10.2 Missing Authorization via DetailUserRole Entry Pointhttps://agentprime.io/advisories/CVE-2026-108712/https://agentprime.io/advisories/CVE-2026-108712/CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Sun, 11 Oct 2026 12:19:26 GMTCVECVE-2019-25664: SuiteCRM 7.10.7 SQL Injection via record Parameterhttps://agentprime.io/advisories/CVE-2019-25664/https://agentprime.io/advisories/CVE-2019-25664/CVSS 7.1 (High). Published by the CVE Program. Not analysed by agentprime yet.Sun, 05 Apr 2026 20:45:18 GMTCVECVE-2019-25663: SuiteCRM 7.10.7 SQL Injection via parentTab Parameterhttps://agentprime.io/advisories/CVE-2019-25663/https://agentprime.io/advisories/CVE-2019-25663/CVSS 7.1 (High). Published by the CVE Program. Not analysed by agentprime yet.Sun, 05 Apr 2026 20:45:17 GMTCVECVE-2026-33289: SuiterCRM has LDAP Filter Injection in Authentication Modulehttps://agentprime.io/advisories/CVE-2026-33289/https://agentprime.io/advisories/CVE-2026-33289/CVSS 8.8 (High). Published by the CVE Program. Not analysed by agentprime yet.Thu, 19 Mar 2026 23:09:07 GMTCVECVE-2026-33288: SuiteCRM has Authenticated SQL Injection in Authentication Modulehttps://agentprime.io/advisories/CVE-2026-33288/https://agentprime.io/advisories/CVE-2026-33288/CVSS 8.8 (High). Published by the CVE Program. Not analysed by agentprime yet.Thu, 19 Mar 2026 23:08:11 GMTCVECVE-2026-29189: SuiteCRM has a REST API V8 IDOR: Missing ACL Checks on User Preferences and Relationship Endpointshttps://agentprime.io/advisories/CVE-2026-29189/https://agentprime.io/advisories/CVE-2026-29189/CVSS 8.1 (High). Published by the CVE Program. Not analysed by agentprime yet.Thu, 19 Mar 2026 23:05:16 GMTCVECVE-2026-29107: SuiteCRM vulnerable to authenticated SSRF via PDF exporthttps://agentprime.io/advisories/CVE-2026-29107/https://agentprime.io/advisories/CVE-2026-29107/CVSS 5.0 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Thu, 19 Mar 2026 23:04:12 GMTCVECVE-2026-29106: SuiteCRM has blind XSS in return_id parameterhttps://agentprime.io/advisories/CVE-2026-29106/https://agentprime.io/advisories/CVE-2026-29106/CVSS 5.9 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Thu, 19 Mar 2026 23:02:19 GMTCVECVE-2026-29105: SuiteCRM has Unauthenticated Open Redirect in Leads WebToLead Capturehttps://agentprime.io/advisories/CVE-2026-29105/https://agentprime.io/advisories/CVE-2026-29105/CVSS 5.4 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Thu, 19 Mar 2026 22:58:48 GMTCVECVE-2026-29104: SuiteCRM Vulnerable to Authenticated Arbitrary File Upload via Configurator addfontresult View in SuiteCRMhttps://agentprime.io/advisories/CVE-2026-29104/https://agentprime.io/advisories/CVE-2026-29104/CVSS 2.7 (Low). Published by the CVE Program. Not analysed by agentprime yet.Thu, 19 Mar 2026 22:55:51 GMTCVECVE-2026-29103: SuiteCRM Vulnerable to Remote Code Execution via Module Loader Package Scanner Bypasshttps://agentprime.io/advisories/CVE-2026-29103/https://agentprime.io/advisories/CVE-2026-29103/CVSS 9.1 (Critical). Critical: CVSS score 9.1: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Thu, 19 Mar 2026 22:54:34 GMTCVEcriticalCVE-2026-29102: SuiteCRM has Authenticated RCE in Moduleshttps://agentprime.io/advisories/CVE-2026-29102/https://agentprime.io/advisories/CVE-2026-29102/CVSS 7.2 (High). Published by the CVE Program. Not analysed by agentprime yet.Thu, 19 Mar 2026 22:53:09 GMTCVECVE-2026-29101: SuiteCRM Vulnerable to Directory Traversal to DoS in Moduleshttps://agentprime.io/advisories/CVE-2026-29101/https://agentprime.io/advisories/CVE-2026-29101/CVSS 4.9 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Thu, 19 Mar 2026 22:51:47 GMTCVECVE-2026-29100: SuiteCRM has Reflected HTML Injection in Login Page via default_user_name Parameterhttps://agentprime.io/advisories/CVE-2026-29100/https://agentprime.io/advisories/CVE-2026-29100/CVSS 7.1 (High). Published by the CVE Program. Not analysed by agentprime yet.Thu, 19 Mar 2026 22:48:49 GMTCVECVE-2026-29099: SuiteCRM has Authenticated Blind SQL Injection in OutboundEmail Legacy Functionality.https://agentprime.io/advisories/CVE-2026-29099/https://agentprime.io/advisories/CVE-2026-29099/CVSS 8.8 (High). Published by the CVE Program. Not analysed by agentprime yet.Thu, 19 Mar 2026 22:46:56 GMTCVECVE-2026-29098: SuiteCRM has Relative Path Traversal via ModuleBuilder Modules ExportCustom Actionhttps://agentprime.io/advisories/CVE-2026-29098/https://agentprime.io/advisories/CVE-2026-29098/CVSS 4.9 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Thu, 19 Mar 2026 22:43:58 GMTCVECVE-2026-29097: SuiteCRM Server-Side Request Forgery and Denial of Service via RSS Feed Dashlethttps://agentprime.io/advisories/CVE-2026-29097/https://agentprime.io/advisories/CVE-2026-29097/CVSS 7.1 (High). Published by the CVE Program. Not analysed by agentprime yet.Thu, 19 Mar 2026 22:39:03 GMTCVECVE-2026-29096: SuiteCRM vulnerable to Authenticated SQL Injection via unsanitized field_function in Report Fieldshttps://agentprime.io/advisories/CVE-2026-29096/https://agentprime.io/advisories/CVE-2026-29096/CVSS 8.1 (High). Published by the CVE Program. Not analysed by agentprime yet.Thu, 19 Mar 2026 22:37:51 GMTCVE