Skip to content
Suitecrm vulnerabilities
Newest
-
suitecrm
SuiteCRM: Admin OS RCE via Dropdown Editor PHP Injection
CVE-2026-100358
9.4 Critical
-
suitecrm
SuiteCRM: Privilege escalation via V8 REST modules (ACLRoles, ACLActions, Administration)
CVE-2026-100363
8.8 High
-
suitecrm
SuiteCRM: Authenticated SQL Injection In action_get_end_date function
CVE-2026-100359
6.5 Medium
-
suitecrm
SuiteCRM: V8 OAuth2 Username Enumeration
CVE-2026-100362
6.9 Medium
-
suitecrm
SuiteCRM: Authenticated SQL Injection in SOAP Portal Method portal_get_entry_list
CVE-2026-97377
8.8 High
-
suitecrm
SuiteCRM: V8 API Relationship Delete Bypasses Object-Level Authorization on the Related Record
CVE-2026-100360
7.1 High
-
suitecrm
SuiteCRM: Mass Assignment in V8 API Allows Modification of Sensitive User Fields (user_hash, external_auth_only)
CVE-2026-100361
7.1 High
-
suitecrm
SuiteCRM V8 JSON:API processAttributes() Missing ID Filter Allows ACL Bypass and Record Ownership Hijack
CVE-2026-100364
7.1 High
-
suitecrm
SuiteCRM: Time-Based Blind SQL Injection via AOR_Reports ORDER BY Clause Allows Data Exfiltration by Any Authenticated User
CVE-2026-100365
8.8 High
-
suitecrm
SuiteCRM: Authenticated SQL Injection in AOR_Reports `parameter_value` (value_type=Field) allows any low-privileged user to read the full database
CVE-2026-71548
8.8 High
-
suitecrm
SuiteCRM: LFI to RCE via AOW_WorkFlow
CVE-2026-71550
9.9 Critical
-
suitecrm
SuiteCRM: SQL Injection via REST API securexss() Bypass in Relationship Management
CVE-2026-69134
8.8 High
-
suitecrm
SuiteCRM: SQL injection via search param in modules/Cases/controller.php
CVE-2026-69141
8.3 High
-
suitecrm
SuiteCRM: Authenticated SQL Injection in map_markers distance Parameter
CVE-2026-69142
8.8 High
-
suitecrm
SuiteCRM: SQL injection via get_latest_for_id param in GetLatestRevision.php
CVE-2026-69140
8.3 High
-
suitecrm
SuiteCRM: AOR Reports aor_fields.field SQL Injection
CVE-2026-69145
6.5 Medium
-
suitecrm
SuiteCRM: Authenticated SQL Injection In handleAttachments function
CVE-2026-69136
7.1 High
-
suitecrm
SuiteCRM: Authenticated SQL Injection In Project Module
CVE-2026-69135
7.1 High
-
suitecrm
SuiteCRM: Authorization Bypass via Document Revision ID Confusion in download.php
CVE-2026-69144
6.5 Medium
-
suitecrm
SuiteCRM: Authenticated SSRF in CalendarAccount testConnection Allows Internal Network Access and Response Disclosure
CVE-2026-69137
Public exploit
7.7 High
-
suitecrm
SuiteCRM: SQL injection via parameter_value[0] param in AOR_Report.php
CVE-2026-61648
8.3 High
-
suitecrm
SuiteCRM: Incorrect Access Control in V8 relationship creation via missing edit authorization
CVE-2026-61650
8.1 High
-
suitecrm
SuiteCRM: SQL injection via id param in modules/Campaigns/PopupCampaignRoi.php
CVE-2026-61653
8.3 High
-
suitecrm
SuiteCRM: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in SuiteCRM
CVE-2026-63213
7.2 High
-
suitecrm
SuiteCRM: isSelfRequest() bypass via substring match allows SSRF to internal services
CVE-2026-61649
7.7 High
-
suitecrm
SuiteCRM: Time-Based Blind SQL Injection via REST API
CVE-2026-63215
8.3 High
-
suitecrm
SuiteCRM: IDOR in generatePdf Entry Point Allows Record Data Exfiltration
CVE-2026-63217
6.5 Medium
-
suitecrm
SuiteCRM: Authenticated SQL Injection in v4_1 get_entry_list rest api
CVE-2026-63214
8.8 High
-
suitecrm
SuiteCRM: Record-level Authorization Bypass via AOR_Reports changeReportPage
CVE-2026-63218
6.5 Medium
-
suitecrm
SuiteCRM: Authenticated SQL Injection in get_end_date function in Project Controller
CVE-2026-61651
8.3 High
-
suitecrm
SuiteCRM: Non-admin user creates SchedulersJob: SSRF via cron
CVE-2026-63111
7.1 High
-
suitecrm
SuiteCRM through 7.15.2 and 8.10.2 Missing Authorization via setCampaignMarketingAndTemplate
CVE-2026-108713
5.3 Medium
-
suitecrm
SuiteCRM through 7.15.2 and 8.10.2 Missing Authorization via DetailUserRole Entry Point
CVE-2026-108712
5.3 Medium
-
salesagility suitecrm
SuiteCRM 7.10.7 SQL Injection via record Parameter
CVE-2019-25664
7.1 High
-
salesagility suitecrm
SuiteCRM 7.10.7 SQL Injection via parentTab Parameter
CVE-2019-25663
7.1 High
-
suitecrm, suitecrm suitecrm-core +1 more
SuiteCRM: RecordHandler::getRecord() missing ACLAccess('view') check allows any authenticated user to read any record (IDOR)
CVE-2026-32697
6.5 Medium
-
suitecrm, suitecrm suitecrm-core +1 more
SuiteCRM Authenticated Remote Code Execution via Unsafe Deserialization in SavedSearch Filter Processing
CVE-2026-29109
8.6 High
-
suitecrm, suitecrm suitecrm-core +1 more
Authenticated SuiteCRM Users Can Retrieve The Password Hash of Any User
CVE-2026-29108
6.5 Medium
-
suitecrm
SuiterCRM has LDAP Filter Injection in Authentication Module
CVE-2026-33289
8.8 High
-
suitecrm
SuiteCRM has Authenticated SQL Injection in Authentication Module
CVE-2026-33288
8.8 High
-
suitecrm
SuiteCRM has a REST API V8 IDOR: Missing ACL Checks on User Preferences and Relationship Endpoints
CVE-2026-29189
8.1 High
-
suitecrm
SuiteCRM vulnerable to authenticated SSRF via PDF export
CVE-2026-29107
5.0 Medium
-
suitecrm
SuiteCRM has blind XSS in return_id parameter
CVE-2026-29106
5.9 Medium
-
suitecrm
SuiteCRM has Unauthenticated Open Redirect in Leads WebToLead Capture
CVE-2026-29105
5.4 Medium
-
suitecrm
SuiteCRM Vulnerable to Authenticated Arbitrary File Upload via Configurator addfontresult View in SuiteCRM
CVE-2026-29104
2.7 Low
-
suitecrm
SuiteCRM Vulnerable to Remote Code Execution via Module Loader Package Scanner Bypass
CVE-2026-29103
9.1 Critical
-
suitecrm
SuiteCRM has Authenticated RCE in Modules
CVE-2026-29102
7.2 High
-
suitecrm
SuiteCRM Vulnerable to Directory Traversal to DoS in Modules
CVE-2026-29101
4.9 Medium
-
suitecrm
SuiteCRM has Reflected HTML Injection in Login Page via default_user_name Parameter
CVE-2026-29100
7.1 High
-
suitecrm
SuiteCRM has Authenticated Blind SQL Injection in OutboundEmail Legacy Functionality.
CVE-2026-29099
8.8 High
- Show olderLoading…