SalesAgility SuiteCRM

Persistent cross-site scripting (XSS) in the web interface of SuiteCRM before 7.11.19 allows a remote attacker to introduce arbitrary JavaScript via a Content-Type Filter bypass to upload malicious files. This occurs because text/html is blocked, but other types that allow JavaScript execution (such as text/xml) are not blocked.

Persistent cross-site scripting (XSS) in the web interface of SuiteCRM before 7.11.19 allows a remote attacker to introduce arbitrary JavaScript via malicious SVG files. This occurs because the clean_file_output protection mechanism can be bypassed.

A persistent cross-site scripting (XSS) issue in the web interface of SuiteCRM before 7.10.35, and 7.11.x and 7.12.x before 7.12.2, allows a remote attacker to introduce arbitrary JavaScript via attachments upload, a different vulnerability than CVE-2021-39267 and CVE-2021-39268.

SuiteCRM through 7.11.13 has an Open Redirect in the Documents module via a crafted SVG document.

SuiteCRM 7.10.x and 7.11.x before 7.10.20 and 7.11.8 has XSS.

An XSS issue was discovered in SalesAgility SuiteCRM 7.x before 7.8.21 and 7.10.x before 7.10.8, related to phishing an error message.

An XSS combined with CSRF vulnerability discovered in SalesAgility SuiteCRM 7.x before 7.8.24 and 7.10.x before 7.10.11 leads to cookie stealing, aka session hijacking. This issue affects the "add dashboard pages" feature where users can receive a malicious attack through a phished URL, with script executed.

SuiteCRM-Core Host Header Injection in /legacy

SuiteCRM: Reflected Cross Site Scripting (XSS) through HTTP Referrer header

SuiteCRM is vulnerable to unauthenticated reflected XSS through its Login page

Reflected Cross-Site Scripting (XSS) in SuiteCRM

XSS in the client account page in SuiteCRM before 7.11.19 allows an attacker to inject JavaScript via the name field

SuiteCRM 7.11.13 is affected by stored Cross-Site Scripting (XSS) in the Documents preview functionality. This vulnerability could allow remote authenticated attackers to inject arbitrary web script or HTML.

Unrestricted Upload of File with Dangerous Type in salesagility/suitecrm

Authenticated XSS in "Publish Key" Field Allowing Unauthorized Administrator User Creation in SuiteCRM

SuiteCRM vulnerable to open redirects

SuiteCRM has Unauthenticated Graphql Introspection Enabled

SuiteCRM before 7.10.33 and 7.11.22 allows information disclosure via Directory Traversal. An attacker can partially include arbitrary files via the file_name parameter of the Step3 import functionality.

SuiteCRM before 7.10.33 and 7.11.22 allows information disclosure via Directory Traversal. An attacker can partially include arbitrary files via the importFile parameter of the RefreshMapping import functionality.

SuiteCRM 7.10.x before 7.10.20 and 7.11.x before 7.11.8 allows unintended public exposure of files.

SuiteCRM 7.10.x prior to 7.10.21 and 7.11.x prior to 7.11.9 does not correctly implement the .htaccess protection mechanism.

SuiteCRM: Legacy iCal service allows unauthenticated access to meeting data

Server-Side Request Forgery (SSRF) in salesagility/suitecrm

Suite CRM v7.14.2 - SSRF

SuiteCRM: Improper Authorization for attachment downloads