salesagility

Records105All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical27CVSS 9.0–10.0

CVSS high42CVSS 7.0–8.9

Exploited now

salesagility records in CISA KEV

No salesagility vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records

Suitecrm 105 records HIGH

Records

105 records

TI-2023-05636 CVE-2023-6131 · GHSA-g72v-3gfv-88x3

Code Injection in salesagility/suitecrm

HIGH 73

Code Injection in GitHub repository salesagility/suitecrm prior to 7.14.2, 7.12.14, 8.4.2.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.01003 Published 2023-11-14 Fixed in 7.14.2, 7.12.14 +1 CWE-94

TI-2023-03386 CVE-2023-3627 · GHSA-qg9r-8vq4-2gp4

Cross-Site Request Forgery (CSRF) in salesagility/suitecrm-core

HIGH 73

Cross-Site Request Forgery (CSRF) in GitHub repository salesagility/suitecrm-core prior to 8.3.1.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.0035 Published 2023-07-11 Fixed in 8.3.1 CWE-352

TI-2022-22252 CVE-2022-45185 · GHSA-qjmp-rfrj-7cv5

An issue was discovered in SuiteCRM 7.12.7.

HIGH 73

An issue was discovered in SuiteCRM 7.12.7.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.01169 Published 2025-01-07 No fix listed CWE-502

TI-2020-17178 CVE-2020-28328 · GHSA-4c2c-97pg-w9x9

SuiteCRM before 7.11.17 is vulnerable to remote code execution via the system settings…

HIGH 73

SuiteCRM before 7.11.17 is vulnerable to remote code execution via the system settings Log File Name setting.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.63267 Published 2020-11-06 No fix listed CWE-434

TI-2023-04923 CVE-2023-5350 · GHSA-rvrx-x4gm-4fm2

SQL Injection in salesagility/suitecrm

HIGH 72

SQL Injection in GitHub repository salesagility/suitecrm prior to 7.14.1.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.02173 Published 2023-10-03 Fixed in 7.14.1 CWE-89

TI-2021-19004 CVE-2021-42840 · GHSA-9rqh-fr4c-99v2

SuiteCRM before 7.11.19 allows remote code execution via the system settings Log File…

HIGH 72

SuiteCRM before 7.11.19 allows remote code execution via the system settings Log File Name setting.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.58597 Published 2021-10-22 No fix listed CWE-434

TI-2023-00979 CVE-2023-1034 · GHSA-3mmf-6wp6-5hfj

Path Traversal: '\..\filename' in salesagility/suitecrm

HIGH 71

Path Traversal: '\..\filename' in GitHub repository salesagility/suitecrm prior to 7.12.9.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.26197 Published 2023-02-25 Fixed in 7.12.9 CWE-29

TI-2022-22253 CVE-2022-45186 · GHSA-23fx-r767-q5g7

An issue was discovered in SuiteCRM 7.12.7.

HIGH 70

An issue was discovered in SuiteCRM 7.12.7.

CVSS 3.1HIGH 8.1 Network Low privileges No interaction EPSS 0.00569 Published 2025-01-07 No fix listed

TI-2022-07913 CVE-2022-23940 · GHSA-26v2-hwwj-jjg2

SuiteCRM through 7.12.1 and 8.x through 8.0.1 allows Remote Code Execution.

HIGH 70

SuiteCRM through 7.12.1 and 8.x through 8.0.1 allows Remote Code Execution.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.53515 Published 2022-03-07 No fix listed CWE-502

TI-2023-04926 CVE-2023-5353 · GHSA-vr9r-v9gj-9422

Improper Access Control in salesagility/suitecrm

MEDIUM 64

Improper Access Control in GitHub repository salesagility/suitecrm prior to 7.14.1.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00678 Published 2023-10-03 Fixed in 7.14.1 CWE-284

TI-2019-15717 CVE-2019-25664 · GHSA-hmmj-f3hm-rx3f

SuiteCRM 7.10.7 SQL Injection via record Parameter

MEDIUM 64

SuiteCRM 7.10.7 contains a time-based SQL injection vulnerability in the record parameter of the Users module DetailView action that allows authenticated attackers to manipulate database queries.

CVSS 4.0HIGH 7.1 Network Low privileges No interaction EPSS 0.00356 Published 2026-04-05 No fix listed CWE-89

TI-2019-15716 CVE-2019-25663 · GHSA-hrmj-mfh9-v52r

SuiteCRM 7.10.7 SQL Injection via parentTab Parameter

MEDIUM 64

SuiteCRM 7.10.7 contains a SQL injection vulnerability that allows authenticated attackers to manipulate database queries by injecting SQL code through the parentTab parameter.

CVSS 4.0HIGH 7.1 Network Low privileges No interaction EPSS 0.00356 Published 2026-04-05 No fix listed CWE-89

TI-2025-39885 CVE-2025-64493

SuiteCRM is Vulnerable to Authenticated Blind SQL Injection via GraphQL

MEDIUM 62

SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.0035 Published 2025-11-08 Fixed in 8.9.1 CWE-89

TI-2025-39883 CVE-2025-64491

SuiteCRM is vulnerable to unauthenticated reflected XSS through its Login page

MEDIUM 60

SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.0021 Published 2025-11-08 Fixed in 7.14.8 CWE-79

TI-2023-04924 CVE-2023-5351 · GHSA-f9g9-x8qv-qj56

Cross-site Scripting (XSS) - Stored in salesagility/suitecrm

MEDIUM 60

Cross-site Scripting (XSS) - Stored in GitHub repository salesagility/suitecrm prior to 7.14.1.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00543 Published 2023-10-03 Fixed in 7.14.1 CWE-79

TI-2024-24198 CVE-2024-36412

SuiteCRM unauthenticated SQL Injection

MEDIUM 57

SuiteCRM is an open-source Customer Relationship Management (CRM) software application.

CVSS 3.1CRITICAL 10.0 Network No auth No interaction EPSS 0.05692 Published 2024-06-10 Fixed in 7.14.4, 8.6.1 CWE-89

TI-2023-25783 CVE-2023-47643

SuiteCRM has Unauthenticated Graphql Introspection Enabled

MEDIUM 57

SuiteCRM is a Customer Relationship Management (CRM) software application.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.03002 Published 2023-11-21 Fixed in 8.4.2 CWE-200

TI-2023-03082 CVE-2023-3293 · GHSA-2c9q-7wm6-r5xc

Cross-site Scripting (XSS) - Stored in salesagility/suitecrm-core

MEDIUM 55

Cross-site Scripting (XSS) - Stored in GitHub repository salesagility/suitecrm-core prior to 8.3.0.

CVSS 3.1MEDIUM 4.8 Network High privileges User interaction EPSS 0.00547 Published 2023-06-16 Fixed in 8.3.0 CWE-79

TI-2023-05629 CVE-2023-6124 · GHSA-rwcc-rgpq-6qv7

Server-Side Request Forgery (SSRF) in salesagility/suitecrm

MEDIUM 53

Server-Side Request Forgery (SSRF) in GitHub repository salesagility/suitecrm prior to 7.14.2, 8.4.2, 7.12.14.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00496 Published 2023-11-14 Fixed in 7.14.2, 8.4.2 +1 CWE-918

TI-2022-10489 CVE-2022-27474 · GHSA-j75h-79pp-qgmg

SuiteCRM v7.11.23 was discovered to allow remote code execution via a crafted payload…

MEDIUM 52

SuiteCRM v7.11.23 was discovered to allow remote code execution via a crafted payload injected into the FirstName text field.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.2307 Published 2022-04-15 No fix listed

TI-2022-26063 CVE-2022-50589 · GHSA-wj94-phrx-4jq9

SuiteCRM < 7.12.6 SQL Injection via 'export' Functionality

MEDIUM 49

SuiteCRM versions prior to 7.12.6 contain a SQL injection vulnerability within the processing of the ‘uid’ parameter within the ‘export’ functionality.

CVSS 4.0CRITICAL 9.3 Network No auth No interaction EPSS 0.00689 Published 2025-11-06 Fixed in 7.12.6 CWE-89

TI-2020-07062 CVE-2020-8803 · GHSA-fx9c-gghh-f7ww

SuiteCRM through 7.11.11 allows Directory Traversal to include arbitrary .php files…

MEDIUM 48

SuiteCRM through 7.11.11 allows Directory Traversal to include arbitrary .php files within the webroot via add_to_prospect_list.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.03308 Published 2020-02-13 No fix listed CWE-22

TI-2024-24202 CVE-2024-36416

SuiteCRM v4 API Excessive log data DOS

MEDIUM 47

SuiteCRM is an open-source Customer Relationship Management (CRM) software application.

CVSS 3.1HIGH 8.6 Network No auth No interaction EPSS 0.01952 Published 2024-06-10 Fixed in 7.14.4, 8.6.1 CWE-779

TI-2020-07061 CVE-2020-8802 · GHSA-78cx-cxhf-fjh9

SuiteCRM through 7.11.11 has Incorrect Access Control via action_saveHTMLField Bean Manipulation.

MEDIUM 47

SuiteCRM through 7.11.11 has Incorrect Access Control via action_saveHTMLField Bean Manipulation.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.02608 Published 2020-02-13 No fix listed CWE-89

TI-2025-39880 CVE-2025-64488

SuiteCRM: Authenticated SQL Injection Possible in Reschedule Call Module

MEDIUM 46

SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application.

CVSS 4.0HIGH 8.6 Network Low privileges No interaction EPSS 0.0046 Published 2025-11-07 Fixed in 8.9.1, 7.14.8 CWE-89

Open these records in search →