SugarCRM

Records70All Threatist records

Exploited (KEV)1In CISA KEV

CVSS critical7CVSS 9.0–10.0

CVSS high43CVSS 7.0–8.9

Exploited now

SugarCRM records in CISA KEV

TI-2023-09083 Multiple SugarCRM Products Remote Code Execution Vulnerability CRITICAL 97KEV 2023-02-02

Components

Products in the NVD configurations · select one to filter the records

Sugarcrm 63 records CRITICAL Sugar Suite 3 records LOW Sugar Sales 2 records MEDIUM

Records

70 records

TI-2023-09083 CVE-2023-22952 · GHSA-g9w6-c3gx-pmr3

In SugarCRM before 12.0.

CRITICAL 97KEV

In SugarCRM before 12.0.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.80139 Published 2023-01-11 No fix listed CWE-94

TI-2012-00639 CVE-2012-0694 · GHSA-4hgx-j8rf-29x9

SugarCRM CE <= 6.3.1 contains scripts that use "unserialize()" with user controlled input…

HIGH 79

SugarCRM CE <= 6.3.1 contains scripts that use "unserialize()" with user controlled input which allows remote attackers to execute arbitrary PHP code.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.67256 Published 2019-10-29 No fix listed CWE-20

TI-2025-18706 CVE-2025-25034 · GHSA-wcx8-f39f-5c87

SugarCRM PHP Deserialization RCE

HIGH 75

A PHP object injection vulnerability exists in SugarCRM versions prior to 6.5.24, 6.7.13, 7.5.2.5, 7.6.2.2, and 7.7.1.0 due to improper validation of PHP serialized input in the SugarRestSerialize.php script.

CVSS 4.0CRITICAL 9.3 Network No auth No interaction EPSS 0.04963 Published 2025-06-20 Fixed in 6.5.24, 6.7.13 +3 CWE-502

TI-2023-17895 CVE-2023-35811 · GHSA-hxx9-xh5r-fc5x

An issue was discovered in SugarCRM Enterprise before 11.0.6 and 12.x before 12.0.3.

HIGH 73

An issue was discovered in SugarCRM Enterprise before 11.0.6 and 12.x before 12.0.3.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00967 Published 2023-06-17 No fix listed CWE-89

TI-2023-17892 CVE-2023-35808 · GHSA-f3h2-p3h5-r6w7

An issue was discovered in SugarCRM Enterprise before 11.0.6 and 12.x before 12.0.3.

HIGH 73

An issue was discovered in SugarCRM Enterprise before 11.0.6 and 12.x before 12.0.3.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.01255 Published 2023-06-17 No fix listed CWE-434

TI-2023-17894 CVE-2023-35810 · GHSA-mqpw-mc8r-75fm

An issue was discovered in SugarCRM Enterprise before 11.0.6 and 12.x before 12.0.3.

HIGH 67

An issue was discovered in SugarCRM Enterprise before 11.0.6 and 12.x before 12.0.3.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.01222 Published 2023-06-17 No fix listed CWE-74

TI-2024-38359 CVE-2024-58258 · GHSA-828p-92r7-xw6x

Code injection in SugarCRM

MEDIUM 58

SugarCRM before 13.0.4 and 14.x before 14.0.1 allows SSRF in the API module because a limited type of code injection can occur.

CVSS 3.1HIGH 7.2 Network No auth No interaction EPSS 0.2238 Published 2025-07-13 Fixed in 13.0.4, 14.0.1 CWE-94

TI-2019-11167 CVE-2019-14974 · GHSA-rfcp-3cjj-pm8m

SugarCRM Enterprise 9.0.0 allows mobile/error-not-supported-platform.html?desktop_url= XSS.

MEDIUM 50

SugarCRM Enterprise 9.0.0 allows mobile/error-not-supported-platform.html?desktop_url= XSS.

CVSS 3.0MEDIUM 6.1 Network No auth User interaction EPSS 0.28433 Published 2019-08-14 No fix listed CWE-79

TI-2014-02589 CVE-2014-3244 · GHSA-7wgc-prfc-r69w

XML external entity (XXE) vulnerability in the RSSDashlet dashlet in SugarCRM before…

MEDIUM 50

XML external entity (XXE) vulnerability in the RSSDashlet dashlet in SugarCRM before 6.5.17 allows remote attackers to read arbitrary files or potentially execute arbitrary code via a crafted DTD in an XML request.

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.05042 Published 2018-02-01 No fix listed CWE-611

TI-2004-01120 CVE-2004-1227 · GHSA-gfv8-v4p2-qcf9

Directory traversal vulnerability in SugarCRM Sugar Sales 2.0.1c and earlier allows…

MEDIUM 50

Directory traversal vulnerability in SugarCRM Sugar Sales 2.0.1c and earlier allows remote attackers to read arbitrary files and possibly execute arbitrary PHP code via ..

CVSS 2.0HIGH 10.0 Network No auth Interaction — EPSS 0.04155 Published 2004-12-15 No fix listed

TI-2020-05995 CVE-2020-7472 · GHSA-rc9r-x5j2-h9cq

An authorization bypass and PHP local-file-include vulnerability in the installation…

MEDIUM 48

An authorization bypass and PHP local-file-include vulnerability in the installation component of SugarCRM before 8.0, 8.0 before 8.0.7, 9.0 before 9.0.4, and 10.0 before 10.0.0 allows for unauthenticated remote code exe…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.03203 Published 2020-11-12 No fix listed CWE-20

TI-2017-10611 CVE-2017-14509 · GHSA-4g2w-mjfj-p2m9

An issue was discovered in SugarCRM before 7.7.2.3, 7.8.x before 7.8.2.2, and 7.9.x…

MEDIUM 47

An issue was discovered in SugarCRM before 7.7.2.3, 7.8.x before 7.8.2.2, and 7.9.x before 7.9.2.0 (and Sugar Community Edition 6.5.26).

CVSS 3.0HIGH 8.8 Network Low privileges No interaction EPSS 0.05766 Published 2017-09-17 No fix listed CWE-20

TI-2009-02053 CVE-2009-2146 · GHSA-fw9h-q663-phqj

Unrestricted file upload vulnerability in the Compose Email feature in the Emails module…

MEDIUM 46

Unrestricted file upload vulnerability in the Compose Email feature in the Emails module in Sugar Community Edition (aka SugarCRM) before 5.2f allows remote authenticated users to execute arbitrary code by uploading a fi…

CVSS 2.0MEDIUM 6.0 Network Low privileges Interaction — EPSS 0.21375 Published 2009-06-22 No fix listed

TI-2004-01118 CVE-2004-1225 · GHSA-rj5f-5fmv-qxm9

SQL injection vulnerability in SugarCRM Sugar Sales before 2.0.1a allows remote attackers…

MEDIUM 46

SQL injection vulnerability in SugarCRM Sugar Sales before 2.0.1a allows remote attackers to execute arbitrary SQL commands and gain privileges via the record parameter in a DetailView action to index.php, and record par…

CVSS 2.0HIGH 10.0 Network No auth Interaction — EPSS 0.0176 Published 2004-12-15 No fix listed

TI-2018-04639 CVE-2018-6308 · GHSA-3vmw-cgj4-4fqj

Multiple SQL injections exist in SugarCRM Community Edition 6.5.26 and below via the…

MEDIUM 44

Multiple SQL injections exist in SugarCRM Community Edition 6.5.26 and below via the track parameter to modules\Campaigns\Tracker.php and modules\Campaigns\utils.php, the default_currency_name parameter to modules\Config…

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.01097 Published 2018-01-25 No fix listed CWE-89

TI-2023-17893 CVE-2023-35809 · GHSA-g83h-qmpp-jpwq

An issue was discovered in SugarCRM Enterprise before 11.0.6 and 12.x before 12.0.3.

MEDIUM 43

An issue was discovered in SugarCRM Enterprise before 11.0.6 and 12.x before 12.0.3.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.01256 Published 2023-06-17 No fix listed CWE-94

TI-2017-10610 CVE-2017-14508 · GHSA-7mw8-x3cx-f3rv

An issue was discovered in SugarCRM before 7.7.2.3, 7.8.x before 7.8.2.2, and 7.9.x…

MEDIUM 43

An issue was discovered in SugarCRM before 7.7.2.3, 7.8.x before 7.8.2.2, and 7.9.x before 7.9.2.0 (and Sugar Community Edition 6.5.26).

CVSS 3.0HIGH 8.8 Network Low privileges No interaction EPSS 0.0257 Published 2017-09-17 No fix listed CWE-89

TI-2019-12913 CVE-2019-17313 · GHSA-rrpm-55f2-9788

SugarCRM before 8.0.4 and 9.x before 9.0.2 allows directory traversal in the Studio module by a Developer user.

MEDIUM 42

SugarCRM before 8.0.4 and 9.x before 9.0.2 allows directory traversal in the Studio module by a Developer user.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.01981 Published 2019-10-07 No fix listed CWE-22

TI-2019-12912 CVE-2019-17312 · GHSA-h2vp-cmg7-f7pm

SugarCRM before 8.0.4 and 9.x before 9.0.2 allows directory traversal in the file function by a Regular user.

MEDIUM 42

SugarCRM before 8.0.4 and 9.x before 9.0.2 allows directory traversal in the file function by a Regular user.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.01981 Published 2019-10-07 No fix listed CWE-22

TI-2019-12911 CVE-2019-17311 · GHSA-grmm-jjw2-g4pg

SugarCRM before 8.0.4 and 9.x before 9.0.2 allows directory traversal in the attachment function by a Regular user.

MEDIUM 42

SugarCRM before 8.0.4 and 9.x before 9.0.2 allows directory traversal in the attachment function by a Regular user.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.01981 Published 2019-10-07 No fix listed CWE-22

TI-2023-25287 CVE-2023-46816 · GHSA-7qj5-3ww5-rm6r

An issue was discovered in SugarCRM 12 before 12.0.4 and 13 before 13.0.2.

MEDIUM 41

An issue was discovered in SugarCRM 12 before 12.0.4 and 13 before 13.0.2.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00721 Published 2023-10-27 No fix listed CWE-94

TI-2023-25286 CVE-2023-46815 · GHSA-gjw6-hpc2-3jfv

An issue was discovered in SugarCRM 12 before 12.0.4 and 13 before 13.0.2.

MEDIUM 41

An issue was discovered in SugarCRM 12 before 12.0.4 and 13 before 13.0.2.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00667 Published 2023-10-27 No fix listed CWE-434

TI-2019-12916 CVE-2019-17316 · GHSA-p6w8-vqv9-2hxj

SugarCRM before 8.0.4 and 9.x before 9.0.2 allows PHP object injection in the Import module by a Regular user.

MEDIUM 41

SugarCRM before 8.0.4 and 9.x before 9.0.2 allows PHP object injection in the Import module by a Regular user.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.01488 Published 2019-10-07 No fix listed CWE-1321

TI-2019-12908 CVE-2019-17308 · GHSA-3m8x-jjr4-6gqq

SugarCRM before 8.0.4 and 9.x before 9.0.2 allows PHP code injection in the Emails module by a Regular user.

MEDIUM 41

SugarCRM before 8.0.4 and 9.x before 9.0.2 allows PHP code injection in the Emails module by a Regular user.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.01401 Published 2019-10-07 No fix listed CWE-94

TI-2019-12905 CVE-2019-17305 · GHSA-v77m-m5xc-jm2q

SugarCRM before 8.0.4 and 9.x before 9.0.2 allows PHP code injection in the MergeRecords module by a Regular user.

MEDIUM 41

SugarCRM before 8.0.4 and 9.x before 9.0.2 allows PHP code injection in the MergeRecords module by a Regular user.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.01401 Published 2019-10-07 No fix listed CWE-94

Open these records in search →