SalesAgility SuiteCRM any version

An XSS combined with CSRF vulnerability discovered in SalesAgility SuiteCRM 7.x before 7.8.24 and 7.10.x before 7.10.11 leads to cookie stealing, aka session hijacking. This issue affects the "add dashboard pages" feature where users can receive a malicious attack through a phished URL, with script executed.

SuiteCRM-Core Host Header Injection in /legacy

SuiteCRM: Reflected Cross Site Scripting (XSS) through HTTP Referrer header

SuiteCRM is vulnerable to unauthenticated reflected XSS through its Login page

XSS in the client account page in SuiteCRM before 7.11.19 allows an attacker to inject JavaScript via the name field

SuiteCRM 7.11.13 is affected by stored Cross-Site Scripting (XSS) in the Documents preview functionality. This vulnerability could allow remote authenticated attackers to inject arbitrary web script or HTML.

Unrestricted Upload of File with Dangerous Type in salesagility/suitecrm

Authenticated XSS in "Publish Key" Field Allowing Unauthorized Administrator User Creation in SuiteCRM

SuiteCRM vulnerable to open redirects

SuiteCRM before 7.10.33 and 7.11.22 allows information disclosure via Directory Traversal. An attacker can partially include arbitrary files via the file_name parameter of the Step3 import functionality.

SuiteCRM before 7.10.33 and 7.11.22 allows information disclosure via Directory Traversal. An attacker can partially include arbitrary files via the importFile parameter of the RefreshMapping import functionality.

SuiteCRM 7.10.x before 7.10.20 and 7.11.x before 7.11.8 allows unintended public exposure of files.

SuiteCRM 7.10.x prior to 7.10.21 and 7.11.x prior to 7.11.9 does not correctly implement the .htaccess protection mechanism.

Server-Side Request Forgery (SSRF) in salesagility/suitecrm

SuiteCRM: Improper Authorization for attachment downloads