Section
Vulnerabilities
CVE records from NVD, ZDI advisories and the CISA KEV catalog, with CVSS, EPSS, SSVC and exploitation state.
31 matching records.
-
SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application.
SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to 7.15.2 and 8.10.2, the workflow controller uses a path-traversal-capable aow_action value in require_once()…
-
SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application.
SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to 7.15.2 and 8.10.2, the Studio Dropdown Editor passes $dropdown_name through html_entity_decode() and writes the…
-
SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application.
SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to 7.15.2 and 8.10.2, the Upgrade Wizard commit flow trusts the hidden zip_to_dir parameter, while clean_path() does…
-
SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application.
SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to 7.15.2 and 8.10.2, AOR report generation concatenates an attacker-controlled stored field label into an ORDER BY…
-
SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application.
SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to 7.15.2 and 8.10.2, the legacy SOAP portal method portal_get_entry_list propagates caller-controlled where and…
-
SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application.
SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to 7.15.2 and 8.10.2, AOR_Report::build_report_query_where incorporates a report editor's parameter_value when…
-
SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application.
SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to 7.15.2 and 8.10.2, the jjwg_Maps map marker endpoint uses the authenticated caller's distance value in the…
-
SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application.
SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to 7.15.2 and 8.10.2, the CasesController action_get_kb_articles action interpolates $_POST['search'] into a CASE…
-
SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application.
SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to 7.15.2 and 8.10.2, GetLatestRevision.php interpolates get_latest_for_id directly into an SQL UPDATE statement.…
-
SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application.
SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to 7.15.2 and 8.10.2, the CalendarAccount testConnection action passes an authenticated caller's server_url directly…
-
SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application.
SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to 7.15.2 and 8.10.2, email template attachment handling passes the remove_attachment POST parameter array through…
-
SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application.
SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to 7.15.2 and 8.10.2, the Project module interpolates the authenticated caller's duplicateId POST parameter directly…
-
SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application.
SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to 7.15.2 and 8.10.2, the REST v4 JSON handler reads the pre-filter RAW_REQUEST value and relationship write helpers…
-
SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application.
SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to 7.15.2 and 8.10.2, the REST API v4.1 get_entry_list method is vulnerable to time-based blind SQL injection when an…
-
SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application.
SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to 7.15.2 and 8.10.2, legacy REST methods append an authenticated caller's query parameter as a SQL WHERE clause…
-
SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application.
SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to 7.15.2 and 8.10.2, the V8 module API lacks module-level authorization and permits a low-privileged user to create…
-
SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application.
SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to 7.15.2 and 8.10.2, modules/Campaigns/PopupCampaignRoi.php interpolates $_REQUEST['id'] into SQL. Although…
-
SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application.
SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to 7.15.2 and 8.10.2, the get_end_date action in Projects Controller concatenates an authenticated caller's task_id…
-
SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application.
SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to 7.15.2 and 8.10.2, the POST /Api/V8/module/{moduleName}/{id}/relationships/{linkFieldName} endpoint checks only…
-
SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application.
SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to 7.15.2 and 8.10.2, the SSRF protection added in 7.15.1 uses a substring comparison in isSelfRequest() rather than…
-
SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application.
SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to 7.15.2 and 8.10.2, a user-controllable Multi report condition passes parameter_value through unencodeMultienum()…
-
SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application.
SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to 7.15.2 and 8.10.2, the V8 JSON:API update path fails to remove the id attribute before assigning user-supplied…
-
SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application.
SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to 7.15.2 and 8.10.2, the V8 module API exposes CRUD operations for administrator-only modules to any authenticated…
-
SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application.
SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to 7.15.2 and 8.10.2, the V8 write path checks that a field exists but does not enforce api-visible or sensitive…
-
SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application.
SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to 7.15.2 and 8.10.2, V8 API relationship write paths do not consistently enforce object-level edit and view…
-
SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application.
SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to 7.15.2 and 8.10.2, AOR report generation reloads the value stored in aor_fields.field and concatenates it into…
-
SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application.
SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to 7.15.2 and 8.10.2, download.php checks authorization against a Documents bean before resolving whether the…
-
SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application.
SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to 7.15.2 and 8.10.2, the changeReportPage controller action renders a protected report without repeating the…
-
SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application.
SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to 7.15.2 and 8.10.2, the generatePdf entry point loads an arbitrary record through BeanFactory::getBean() without…
-
SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application.
SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to 7.15.2 and 8.10.2, the /legacy/Api/V8/OAuth2 password-grant endpoint returns distinct error messages for an…
-
SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application.
SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to 7.15.2 and 8.10.2, the Project Template module's action_get_end_date function interpolates authenticated…
Reuse this view
Same filters as JSON: /api/items?category=vuln&window=30d&vendor=SuiteCRM&limit=100. RSS for this section: feed.xml.