Sugarcrm vulnerabilities

Products

• Sugarcrm 65
• Sugar Suite 3
• Sugar Sales 2

Newest

• sugarcrm SugarCRM before 13.0.4 and 14.x before 14.0.1 allows SSRF in the API module because a limited... CVE-2024-58258 Public exploit EPSS 22.4% 7.2 HighJuly 13, 2025
• sugarcrm SugarCRM PHP Deserialization RCE CVE-2025-25034 Public exploit 9.3 CriticalJune 20, 2025
• sugarcrm An issue was discovered in SugarCRM 12 before 12.0.4 and 13 before 13.0.2. A Server Site Template... CVE-2023-46816 8.8 HighOctober 27, 2023
• sugarcrm An issue was discovered in SugarCRM 12 before 12.0.4 and 13 before 13.0.2. An Unrestricted File... CVE-2023-46815 8.8 HighOctober 27, 2023
• sugarcrm An issue was discovered in SugarCRM Enterprise before 11.0.6 and 12.x before 12.0.3. Two SQL... CVE-2023-35811 8.8 HighJune 17, 2023
• sugarcrm An issue was discovered in SugarCRM Enterprise before 11.0.6 and 12.x before 12.0.3. A Second... CVE-2023-35810 7.2 HighJune 17, 2023
• sugarcrm An issue was discovered in SugarCRM Enterprise before 11.0.6 and 12.x before 12.0.3. A Bean... CVE-2023-35809 8.8 HighJune 17, 2023
• sugarcrm An issue was discovered in SugarCRM Enterprise before 11.0.6 and 12.x before 12.0.3. An... CVE-2023-35808 8.8 HighJune 17, 2023
• sugarcrm, sugarcrm multiple products +1 more In SugarCRM before 12.0. Hotfix 91155, a crafted request can inject custom PHP code through the... CVE-2023-22952 In KEVPublic exploit EPSS 80.1% 8.8 HighJanuary 11, 2023
• sugarcrm SugarCRM v6.5.18 was discovered to contain a cross-site scripting (XSS) vulnerability in the... CVE-2020-28955 5.4 MediumOctober 22, 2021
• sugarcrm Multiple cross-site scripting (XSS) vulnerabilities in the Sales module of SugarCRM v6.5.18... CVE-2020-28956 5.4 MediumOctober 22, 2021
• sugarcrm Multiple cross-site scripting (XSS) vulnerabilities in the Support module of SugarCRM v6.5.18... CVE-2020-36501 5.4 MediumOctober 22, 2021
• sugarcrm An authorization bypass and PHP local-file-include vulnerability in the installation component of... CVE-2020-7472 9.8 CriticalNovember 12, 2020
• sugarcrm SugarCRM before 10.1.0 (Q3 2020) allows SQL Injection. CVE-2020-17373 5.3 MediumAugust 12, 2020
• sugarcrm SugarCRM before 10.1.0 (Q3 2020) allows XSS. CVE-2020-17372 5.4 MediumAugust 12, 2020
• sugarcrm SugarCRM CE <= 6.3.1 contains scripts that use "unserialize()" with user controlled input which... CVE-2012-0694 Public exploit EPSS 67.3% 9.8 CriticalOctober 29, 2019
• sugarcrm SugarCRM before 8.0.4 and 9.x before 9.0.2 allows SQL injection in the pmse_Inbox module by an... CVE-2019-17292 7.2 HighOctober 7, 2019
• sugarcrm SugarCRM before 8.0.4 and 9.x before 9.0.2 allows SQL injection in the pmse_Project module by a... CVE-2019-17293 8.8 HighOctober 7, 2019
• sugarcrm SugarCRM before 8.0.4 and 9.x before 9.0.2 allows SQL injection in the export function by a... CVE-2019-17294 8.8 HighOctober 7, 2019
• sugarcrm SugarCRM before 8.0.4 and 9.x before 9.0.2 allows SQL injection in the history function by a... CVE-2019-17295 8.8 HighOctober 7, 2019
• sugarcrm SugarCRM before 8.0.4 and 9.x before 9.0.2 allows SQL injection in the Contacts module by a... CVE-2019-17296 8.8 HighOctober 7, 2019
• sugarcrm SugarCRM before 8.0.4 and 9.x before 9.0.2 allows SQL injection in the Quotes module by a Regular... CVE-2019-17297 8.8 HighOctober 7, 2019
• sugarcrm SugarCRM before 8.0.4 and 9.x before 9.0.2 allows SQL injection in the Administration module by a... CVE-2019-17298 8.8 HighOctober 7, 2019
• sugarcrm SugarCRM before 8.0.4 and 9.x before 9.0.2 allows PHP code injection in the Administration module... CVE-2019-17299 7.2 HighOctober 7, 2019
• sugarcrm SugarCRM before 8.0.4 and 9.x before 9.0.2 allows PHP code injection in the Administration module... CVE-2019-17300 8.8 HighOctober 7, 2019
• sugarcrm SugarCRM before 8.0.4 and 9.x before 9.0.2 allows PHP code injection in the ModuleBuilder module... CVE-2019-17301 7.2 HighOctober 7, 2019
• sugarcrm SugarCRM before 8.0.4 and 9.x before 9.0.2 allows PHP code injection in the ModuleBuilder module... CVE-2019-17302 8.8 HighOctober 7, 2019
• sugarcrm SugarCRM before 8.0.4 and 9.x before 9.0.2 allows PHP code injection in the MergeRecords module... CVE-2019-17303 8.8 HighOctober 7, 2019
• sugarcrm SugarCRM before 8.0.4 and 9.x before 9.0.2 allows PHP code injection in the MergeRecords module... CVE-2019-17304 7.2 HighOctober 7, 2019
• sugarcrm SugarCRM before 8.0.4 and 9.x before 9.0.2 allows PHP code injection in the MergeRecords module... CVE-2019-17305 8.8 HighOctober 7, 2019
• sugarcrm SugarCRM before 8.0.4 and 9.x before 9.0.2 allows PHP code injection in the Configurator module... CVE-2019-17306 7.2 HighOctober 7, 2019
• sugarcrm SugarCRM before 8.0.4 and 9.x before 9.0.2 allows PHP code injection in the Tracker module by an... CVE-2019-17307 7.2 HighOctober 7, 2019
• sugarcrm SugarCRM before 8.0.4 and 9.x before 9.0.2 allows PHP code injection in the Emails module by a... CVE-2019-17308 8.8 HighOctober 7, 2019
• sugarcrm SugarCRM before 8.0.4 and 9.x before 9.0.2 allows PHP code injection in the EmailMan module by an... CVE-2019-17309 7.2 HighOctober 7, 2019
• sugarcrm SugarCRM before 8.0.4 and 9.x before 9.0.2 allows PHP code injection in the Campaigns module by... CVE-2019-17310 7.2 HighOctober 7, 2019
• sugarcrm SugarCRM before 8.0.4 and 9.x before 9.0.2 allows directory traversal in the attachment function... CVE-2019-17311 8.8 HighOctober 7, 2019
• sugarcrm SugarCRM before 8.0.4 and 9.x before 9.0.2 allows directory traversal in the file function by a... CVE-2019-17312 8.8 HighOctober 7, 2019
• sugarcrm SugarCRM before 8.0.4 and 9.x before 9.0.2 allows directory traversal in the Studio module by a... CVE-2019-17313 8.8 HighOctober 7, 2019
• sugarcrm SugarCRM before 8.0.4 and 9.x before 9.0.2 allows directory traversal in the Configurator module... CVE-2019-17314 7.2 HighOctober 7, 2019
• sugarcrm SugarCRM before 8.0.4 and 9.x before 9.0.2 allows PHP object injection in the Administration... CVE-2019-17315 7.2 HighOctober 7, 2019
• sugarcrm SugarCRM before 8.0.4 and 9.x before 9.0.2 allows PHP object injection in the Import module by a... CVE-2019-17316 8.8 HighOctober 7, 2019
• sugarcrm SugarCRM before 8.0.4 and 9.x before 9.0.2 allows PHP object injection in the UpgradeWizard... CVE-2019-17317 7.2 HighOctober 7, 2019
• sugarcrm SugarCRM before 8.0.4 and 9.x before 9.0.2 allows SQL injection in the pmse_Inbox module by a... CVE-2019-17318 8.8 HighOctober 7, 2019
• sugarcrm SugarCRM before 8.0.4 and 9.x before 9.0.2 allows SQL injection in the Emails module by a Regular... CVE-2019-17319 8.8 HighOctober 7, 2019
• sugarcrm SugarCRM Enterprise 9.0.0 allows mobile/error-not-supported-platform.html?desktop_url= XSS. CVE-2019-14974 Public exploit EPSS 28.4% 6.1 MediumAugust 14, 2019
• sugarcrm Multiple vulnerabilities in YUI and FlashCanvas embedded in SugarCRM Community Edition 6.5.26... CVE-2018-17784 Public exploit 6.1 MediumOctober 10, 2018
• sugarcrm XML external entity (XXE) vulnerability in the RSSDashlet dashlet in SugarCRM before 6.5.17... CVE-2014-3244 9.8 CriticalFebruary 1, 2018
• sugarcrm Multiple SQL injections exist in SugarCRM Community Edition 6.5.26 and below via the track... CVE-2018-6308 9.8 CriticalJanuary 25, 2018
• sugarcrm phprint.php in SugarCRM 3.5.1 has XSS via a parameter name in the query string (aka a $key... CVE-2018-5715 Public exploit 6.1 MediumJanuary 16, 2018
• sugarcrm An issue was discovered in SugarCRM before 7.7.2.3, 7.8.x before 7.8.2.2, and 7.9.x before 7.9.2... CVE-2017-14510 6.1 MediumSeptember 17, 2017
• Show olderLoading…