Read the docs

SuiteCRM

Records71All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical6CVSS 9.0–10.0
CVSS high43CVSS 7.0–8.9

Exploited now

SuiteCRM records in CISA KEV

No SuiteCRM vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records
Suitecrm 19 records MEDIUM

Records

71 records

TI-2019-15717 CVE-2019-25664 · GHSA-hmmj-f3hm-rx3f

SuiteCRM 7.10.7 SQL Injection via record Parameter

Priority MEDIUM 64

SuiteCRM 7.10.7 contains a time-based SQL injection vulnerability in the record parameter of the Users module DetailView action that allows authenticated attackers to manipulate database queries.

CVSS 4.0HIGH 7.1 Network Low privileges No interaction EPSS 0.00356 Published 2026-04-05 No fix listed CWE-89
TI-2019-15716 CVE-2019-25663 · GHSA-hrmj-mfh9-v52r

SuiteCRM 7.10.7 SQL Injection via parentTab Parameter

Priority MEDIUM 64

SuiteCRM 7.10.7 contains a SQL injection vulnerability that allows authenticated attackers to manipulate database queries by injecting SQL code through the parentTab parameter.

CVSS 4.0HIGH 7.1 Network Low privileges No interaction EPSS 0.00356 Published 2026-04-05 No fix listed CWE-89
TI-2026-70691 CVE-2026-108712 · GHSA-qhw8-6crf-m6jv

Missing authorization in SuiteCRM DetailUserRole exposes user ACL data

Priority MEDIUM 57

SuiteCRM through 7.15.2 and 8.10.2 contains a missing authorization vulnerability in the DetailUserRole entry point that allows authenticated non-admin users to view other users' ACL data.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00349 Published 2026-10-11 No fix listed CWE-862
TI-2022-26063 CVE-2022-50589 · GHSA-wj94-phrx-4jq9

SuiteCRM < 7.12.6 SQL Injection via 'export' Functionality

Priority MEDIUM 49

SuiteCRM versions prior to 7.12.6 contain a SQL injection vulnerability within the processing of the ‘uid’ parameter within the ‘export’ functionality.

CVSS 4.0CRITICAL 9.3 Network No auth No interaction EPSS 0.00689 Published 2025-11-06 Fixed in 7.12.6 CWE-89
TI-2024-01527 CVE-2024-1644 · GHSA-52j8-6rx5-297x

Suite CRM v7.14.2 - RCE via Local File Inclusion

Priority MEDIUM 44

Suite CRM version 7.14.2 allows including local php files.

CVSS 3.1CRITICAL 9.9 Network Low privileges No interaction EPSS 0.00856 Published 2024-02-19 No fix listed CWE-434
TI-2022-26064 CVE-2022-50590 · GHSA-c9hp-6rxj-h2wx

SuiteCRM < 7.12.6 Type Confusion via 'deleteAttachment' Functionality

Priority MEDIUM 44

SuiteCRM versions prior to 7.12.6 contain a type confusion vulnerability within the processing of the ‘module’ parameter within the ‘deleteAttachment’ functionality.

CVSS 4.0HIGH 8.8 Network No auth No interaction EPSS 0.00389 Published 2025-11-06 Fixed in 7.12.6 CWE-843
TI-2026-23243 CVE-2026-29102

SuiteCRM has Authenticated RCE in Modules

Priority MEDIUM 41

SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00521 Published 2026-03-19 Fixed in 7.15.1, 8.9.3 CWE-94
TI-2026-85598 CVE-2026-100365

SQL injection in SuiteCRM AOR Reports ORDER BY clause

Priority MEDIUM 40

SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00441 Published 2026-11-05 Fixed in 7.15.2, 8.10.2 CWE-89
Load more
Open these records in search →