SalesAgility SuiteCRM any version

SuiteCRM authenticated RCE using connectors

Authenticated Blind SQL Injection in DeleteRelationShip in SuiteCRM

Authenticated SQL injection in AM_ProjectTemplates controller in SuiteCRM

SuiteCRM: Authenticated SQL Injection Possible in Reschedule Call Module

SuiteCRM: Authenticated Blind SQL Injection in InboundEmail module

RCE in ModuleBuilder in SuiteCRM

SuiteCRM < 7.12.6 Type Confusion via 'deleteAttachment' Functionality

Cross-Site Request Forgery (CSRF) in salesagility/suitecrm-core

SuiteCRM is Vulnerable to Authenticated Time Based Blind SQL Injection

SuiteCRM: Privilege Escalation via Improper Session Invalidation and Inactive User Bypass

SuiteCRM v4 API Excessive log data DOS

SuiteCRM is vulnerable to Cross Site Scripting (XSS) through its email viewer

SuiteCRM's Inconsistent RBAC Enforcement Enables Access Control Bypass

SuiteCRM before 7.2.3 allows remote attackers to execute arbitrary code.

Improper Access Control in salesagility/suitecrm

SuiteCRM - CSV Injection in Accounts Module

SuiteCRM - Account Takeover in Password Reset Functionality

SuiteCRM through 7.11.13 allows CSV Injection via registration fields in the Accounts, Contacts, Opportunities, and Leads modules. These fields are mishandled during a Download Import File Template operation.

SuiteCRM authenticated Server-Side Request Forgery

SuiteCRM has wrong deletion permission checks on API delete call

Cross-site Scripting (XSS) - Stored in salesagility/suitecrm-core

SuiteCRM 7.10.x versions prior to 7.10.23 and 7.11.x versions prior to 7.11.11 allow for an invalid Bean ID to be submitted.

SuiteCRM through 7.11.11 allows PHAR Deserialization.

ModuleScanner flaws in SuiteCRM

SQL Injection in salesagility/suitecrm

Missing Authorization in salesagility/suitecrm

SuiteCRM 7.10.7 SQL Injection via record Parameter

SuiteCRM 7.10.7 SQL Injection via parentTab Parameter

Cross-site Scripting (XSS) - Reflected in salesagility/suitecrm

SuiteCRM through 7.11.10 allows SQL Injection via the SOAP API, the EmailUIAjax interface, or the MailMerge module.

Missing Authorization in salesagility/suitecrm

SuiteCRM is Vulnerable to Authenticated Blind SQL Injection via GraphQL

SuiteCRM unauthenticated user password reset on php7

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in SuiteCRM

Persistent cross-site scripting (XSS) in the web interface of SuiteCRM before 7.11.19 allows a remote attacker to introduce arbitrary JavaScript via a Content-Type Filter bypass to upload malicious files. This occurs because text/html is blocked, but other types that allow JavaScript execution (such as text/xml) are not blocked.

Persistent cross-site scripting (XSS) in the web interface of SuiteCRM before 7.11.19 allows a remote attacker to introduce arbitrary JavaScript via malicious SVG files. This occurs because the clean_file_output protection mechanism can be bypassed.

A persistent cross-site scripting (XSS) issue in the web interface of SuiteCRM before 7.10.35, and 7.11.x and 7.12.x before 7.12.2, allows a remote attacker to introduce arbitrary JavaScript via attachments upload, a different vulnerability than CVE-2021-39267 and CVE-2021-39268.

SuiteCRM through 7.11.13 has an Open Redirect in the Documents module via a crafted SVG document.

SuiteCRM 7.10.x and 7.11.x before 7.10.20 and 7.11.8 has XSS.

An XSS issue was discovered in SalesAgility SuiteCRM 7.x before 7.8.21 and 7.10.x before 7.10.8, related to phishing an error message.