Vulnerabilities

TI-2026-25189 CVE-2026-32697

Authorization bypass in SuiteCRM-Core

LOW 29

SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00291 Published 2026-03-19 Fixed in 8.9.3 CWE-639

TI-2026-23250 CVE-2026-29109

SuiteCRM Authenticated Remote Code Execution via Unsafe Deserialization in SavedSearch Filter Processing

MEDIUM 40

SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application.

CVSS 4.0HIGH 8.6 Network High privileges No interaction EPSS 0.00497 Published 2026-03-19 Fixed in 8.9.3 CWE-502

TI-2026-23249 CVE-2026-29108

Authenticated SuiteCRM Users Can Retrieve The Password Hash of Any User

LOW 29

SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00325 Published 2026-03-19 Fixed in 8.9.3 CWE-200

TI-2026-25700 CVE-2026-33289

SuiterCRM has LDAP Filter Injection in Authentication Module

MEDIUM 44

SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00703 Published 2026-03-19 Fixed in 7.15.1, 8.9.3 CWE-90

TI-2026-25699 CVE-2026-33288

SuiteCRM has Authenticated SQL Injection in Authentication Module

MEDIUM 40

SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00458 Published 2026-03-19 Fixed in 7.15.1, 8.9.3 CWE-89

TI-2026-23306 CVE-2026-29189

SuiteCRM has a REST API V8 IDOR: Missing ACL Checks on User Preferences and Relationship Endpoints

LOW 37

SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application.

CVSS 3.1HIGH 8.1 Network Low privileges No interaction EPSS 0.00341 Published 2026-03-19 Fixed in 7.15.1, 8.9.3 CWE-639

TI-2026-23248 CVE-2026-29107

SuiteCRM vulnerable to authenticated SSRF via PDF export

LOW 23

SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00179 Published 2026-03-19 Fixed in 7.15.1, 8.9.3 CWE-918

TI-2026-23247 CVE-2026-29106

SuiteCRM has blind XSS in return_id parameter

LOW 26

SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00159 Published 2026-03-19 Fixed in 7.15.1, 8.9.3 CWE-116

TI-2026-23246 CVE-2026-29105

SuiteCRM has Unauthenticated Open Redirect in Leads WebToLead Capture

LOW 27

SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00224 Published 2026-03-19 Fixed in 7.15.1, 8.9.3 CWE-601

TI-2026-23245 CVE-2026-29104

SuiteCRM Vulnerable to Authenticated Arbitrary File Upload via Configurator addfontresult View in SuiteCRM

LOW 13

SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application.

CVSS 3.1LOW 2.7 Network High privileges No interaction EPSS 0.00245 Published 2026-03-19 Fixed in 7.15.1, 8.9.3 CWE-434

TI-2026-23244 CVE-2026-29103

SuiteCRM Vulnerable to Remote Code Execution via Module Loader Package Scanner Bypass

MEDIUM 42

SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application.

CVSS 3.1CRITICAL 9.1 Network High privileges No interaction EPSS 0.00527 Published 2026-03-19 Fixed in 7.15.1, 8.9.3 CWE-358

TI-2026-23243 CVE-2026-29102

SuiteCRM has Authenticated RCE in Modules

MEDIUM 41

SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00521 Published 2026-03-19 Fixed in 7.15.1, 8.9.3 CWE-94

TI-2026-23242 CVE-2026-29101

SuiteCRM Vulnerable to Directory Traversal to DoS in Modules

LOW 33

SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.0048 Published 2026-03-19 Fixed in 7.15.1, 8.9.3 CWE-23

TI-2026-23241 CVE-2026-29100

SuiteCRM has Reflected HTML Injection in Login Page via default_user_name Parameter

LOW 30

SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application.

CVSS 3.1HIGH 7.1 Network No auth User interaction EPSS 0.00171 Published 2026-03-19 Fixed in 7.15.1 CWE-79

TI-2026-23240 CVE-2026-29099

SuiteCRM has Authenticated Blind SQL Injection in OutboundEmail Legacy Functionality.

MEDIUM 40

SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00275 Published 2026-03-19 Fixed in 7.15.1, 8.9.3 CWE-89

TI-2026-23239 CVE-2026-29098

SuiteCRM has Relative Path Traversal via ModuleBuilder Modules ExportCustom Action

LOW 22

SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application.

CVSS 3.1MEDIUM 4.9 Network High privileges No interaction EPSS 0.00349 Published 2026-03-19 Fixed in 7.15.1, 8.9.3 CWE-23

TI-2026-23238 CVE-2026-29097

SuiteCRM Server-Side Request Forgery and Denial of Service via RSS Feed Dashlet

LOW 31

SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application.

CVSS 4.0HIGH 7.1 Network Low privileges No interaction EPSS 0.00314 Published 2026-03-19 Fixed in 7.15.1, 8.9.3 CWE-918

TI-2026-23237 CVE-2026-29096

SuiteCRM vulnerable to Authenticated SQL Injection via unsanitized field_function in Report Fields

LOW 35

SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application.

CVSS 3.1HIGH 8.1 Network Low privileges No interaction EPSS 0.00329 Published 2026-03-19 Fixed in 7.15.1, 8.9.3 CWE-89

TI-2019-13525 CVE-2019-18785 · GHSA-5x6j-j339-95q4

SuiteCRM 7.10.x prior to 7.10.21 and 7.11.x prior to 7.11.9 mishandles API access tokens and credentials.

LOW 35

SuiteCRM 7.10.x prior to 7.10.21 and 7.11.x prior to 7.11.9 mishandles API access tokens and credentials.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01025 Published 2020-03-20 No fix listed CWE-522

Vulnerabilities

Filters