Suitecrm
by Salesagility
Source repositories
CVEs (106)
| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2021-39268 | Med | 0.40 | 6.1 | 0.01 | Aug 18, 2021 | Persistent cross-site scripting (XSS) in the web interface of SuiteCRM before 7.11.19 allows a remote attacker to introduce arbitrary JavaScript via malicious SVG files. This occurs because the clean_file_output protection mechanism can be bypassed. | ||
| CVE-2021-39267 | Med | 0.40 | 6.1 | 0.02 | Aug 18, 2021 | Persistent cross-site scripting (XSS) in the web interface of SuiteCRM before 7.11.19 allows a remote attacker to introduce arbitrary JavaScript via a Content-Type Filter bypass to upload malicious files. This occurs because text/html is blocked, but other types that allow… | ||
| CVE-2020-15300 | Med | 0.40 | 6.1 | 0.01 | Nov 18, 2020 | SuiteCRM through 7.11.13 has an Open Redirect in the Documents module via a crafted SVG document. | ||
| CVE-2019-14752 | Med | 0.40 | 6.1 | 0.01 | Sep 30, 2019 | SuiteCRM 7.10.x and 7.11.x before 7.10.20 and 7.11.8 has XSS. | ||
| CVE-2019-25664 | Hig | 0.39 | 7.1 | 0.00 | Apr 5, 2026 | SuiteCRM 7.10.7 contains a time-based SQL injection vulnerability in the record parameter of the Users module DetailView action that allows authenticated attackers to manipulate database queries. Attackers can append SQL code to the record parameter in GET requests to the… | ||
| CVE-2019-25663 | Hig | 0.39 | 7.1 | 0.00 | Apr 5, 2026 | SuiteCRM 7.10.7 contains a SQL injection vulnerability that allows authenticated attackers to manipulate database queries by injecting SQL code through the parentTab parameter. Attackers can send GET requests to the email module with malicious parentTab values using… | ||
| CVE-2021-41596 | Med | 0.35 | 5.3 | 0.02 | Oct 4, 2021 | SuiteCRM before 7.10.33 and 7.11.22 allows information disclosure via Directory Traversal. An attacker can partially include arbitrary files via the importFile parameter of the RefreshMapping import functionality. | ||
| CVE-2021-41595 | Med | 0.35 | 5.3 | 0.02 | Oct 4, 2021 | SuiteCRM before 7.10.33 and 7.11.22 allows information disclosure via Directory Traversal. An attacker can partially include arbitrary files via the file_name parameter of the Step3 import functionality. | ||
| CVE-2021-31792 | Med | 0.35 | 5.4 | 0.01 | Apr 30, 2021 | XSS in the client account page in SuiteCRM before 7.11.19 allows an attacker to inject JavaScript via the name field | ||
| CVE-2020-14208 | Med | 0.35 | 5.4 | 0.01 | Nov 18, 2020 | SuiteCRM 7.11.13 is affected by stored Cross-Site Scripting (XSS) in the Documents preview functionality. This vulnerability could allow remote authenticated attackers to inject arbitrary web script or HTML. | ||
| CVE-2022-50590 | Med | 0.34 | 5.3 | 0.00 | Nov 6, 2025 | SuiteCRM versions prior to 7.12.6 contain a type confusion vulnerability within the processing of the ‘module’ parameter within the ‘deleteAttachment’ functionality. Successful exploitation allows remote unauthenticated attackers to alter database objects including… | ||
| CVE-2025-54786 | Med | 0.34 | 5.3 | 0.00 | Aug 7, 2025 | SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. In versions 7.14.6 and 8.8.0, the broken authentication in the legacy iCal service allows unauthenticated access to meeting data. An unauthenticated actor can view any… | ||
| CVE-2024-49773 | Med | 0.34 | 5.3 | 0.00 | Nov 5, 2024 | SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Poor input validation in export allows authenticated user do a SQL injection attack. User-controlled input is used to build SQL query. `current_post` parameter in `export`… | ||
| CVE-2023-6388 | Med | 0.33 | 5.0 | 0.00 | Feb 7, 2024 | Suite CRM version 7.14.2 allows making arbitrary HTTP requests through the vulnerable server. This is possible because the application is vulnerable to SSRF. | ||
| CVE-2018-15606 | Med | 0.33 | 6.1 | 0.01 | Sep 26, 2018 | An XSS issue was discovered in SalesAgility SuiteCRM 7.x before 7.8.21 and 7.10.x before 7.10.8, related to phishing an error message. | ||
| CVE-2024-50335 | Med | 0.32 | 4.9 | 0.00 | Nov 5, 2024 | SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. The "Publish Key" field in SuiteCRM's Edit Profile page is vulnerable to Reflected Cross-Site Scripting (XSS), allowing an attacker to inject malicious JavaScript code. This… | ||
| CVE-2024-36417 | Med | 0.30 | 5.7 | 0.00 | Jun 10, 2024 | SuiteCRM is an open-source Customer Relationship Management (CRM) software application. Prior to versions 7.14.4 and 8.6.1, an unverified IFrame can be added some some inputs, which could allow for a cross-site scripting attack. Versions 7.14.4 and 8.6.1 contain a fix for this… | ||
| CVE-2024-36406 | Med | 0.28 | 5.4 | 0.00 | Jun 10, 2024 | SuiteCRM is an open-source Customer Relationship Management (CRM) software application. In versions prior to 7.14.4 and 8.6.1, unchecked input allows for open re-direct. Versions 7.14.4 and 8.6.1 contain a fix for this issue. | ||
| CVE-2019-18782 | Med | 0.28 | 5.3 | 0.01 | Mar 20, 2020 | SuiteCRM 7.10.x prior to 7.10.21 and 7.11.x prior to 7.11.9 does not correctly implement the .htaccess protection mechanism. | ||
| CVE-2019-16922 | Med | 0.28 | 5.3 | 0.01 | Sep 27, 2019 | SuiteCRM 7.10.x before 7.10.20 and 7.11.x before 7.11.8 allows unintended public exposure of files. |
- risk 0.40cvss 6.1epss 0.01
Persistent cross-site scripting (XSS) in the web interface of SuiteCRM before 7.11.19 allows a remote attacker to introduce arbitrary JavaScript via malicious SVG files. This occurs because the clean_file_output protection mechanism can be bypassed.
- risk 0.40cvss 6.1epss 0.02
Persistent cross-site scripting (XSS) in the web interface of SuiteCRM before 7.11.19 allows a remote attacker to introduce arbitrary JavaScript via a Content-Type Filter bypass to upload malicious files. This occurs because text/html is blocked, but other types that allow…
- risk 0.40cvss 6.1epss 0.01
SuiteCRM through 7.11.13 has an Open Redirect in the Documents module via a crafted SVG document.
- risk 0.40cvss 6.1epss 0.01
SuiteCRM 7.10.x and 7.11.x before 7.10.20 and 7.11.8 has XSS.
- risk 0.39cvss 7.1epss 0.00
SuiteCRM 7.10.7 contains a time-based SQL injection vulnerability in the record parameter of the Users module DetailView action that allows authenticated attackers to manipulate database queries. Attackers can append SQL code to the record parameter in GET requests to the…
- risk 0.39cvss 7.1epss 0.00
SuiteCRM 7.10.7 contains a SQL injection vulnerability that allows authenticated attackers to manipulate database queries by injecting SQL code through the parentTab parameter. Attackers can send GET requests to the email module with malicious parentTab values using…
- risk 0.35cvss 5.3epss 0.02
SuiteCRM before 7.10.33 and 7.11.22 allows information disclosure via Directory Traversal. An attacker can partially include arbitrary files via the importFile parameter of the RefreshMapping import functionality.
- risk 0.35cvss 5.3epss 0.02
SuiteCRM before 7.10.33 and 7.11.22 allows information disclosure via Directory Traversal. An attacker can partially include arbitrary files via the file_name parameter of the Step3 import functionality.
- risk 0.35cvss 5.4epss 0.01
XSS in the client account page in SuiteCRM before 7.11.19 allows an attacker to inject JavaScript via the name field
- risk 0.35cvss 5.4epss 0.01
SuiteCRM 7.11.13 is affected by stored Cross-Site Scripting (XSS) in the Documents preview functionality. This vulnerability could allow remote authenticated attackers to inject arbitrary web script or HTML.
- risk 0.34cvss 5.3epss 0.00
SuiteCRM versions prior to 7.12.6 contain a type confusion vulnerability within the processing of the ‘module’ parameter within the ‘deleteAttachment’ functionality. Successful exploitation allows remote unauthenticated attackers to alter database objects including…
- risk 0.34cvss 5.3epss 0.00
SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. In versions 7.14.6 and 8.8.0, the broken authentication in the legacy iCal service allows unauthenticated access to meeting data. An unauthenticated actor can view any…
- risk 0.34cvss 5.3epss 0.00
SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Poor input validation in export allows authenticated user do a SQL injection attack. User-controlled input is used to build SQL query. `current_post` parameter in `export`…
- risk 0.33cvss 5.0epss 0.00
Suite CRM version 7.14.2 allows making arbitrary HTTP requests through the vulnerable server. This is possible because the application is vulnerable to SSRF.
- risk 0.33cvss 6.1epss 0.01
An XSS issue was discovered in SalesAgility SuiteCRM 7.x before 7.8.21 and 7.10.x before 7.10.8, related to phishing an error message.
- risk 0.32cvss 4.9epss 0.00
SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. The "Publish Key" field in SuiteCRM's Edit Profile page is vulnerable to Reflected Cross-Site Scripting (XSS), allowing an attacker to inject malicious JavaScript code. This…
- risk 0.30cvss 5.7epss 0.00
SuiteCRM is an open-source Customer Relationship Management (CRM) software application. Prior to versions 7.14.4 and 8.6.1, an unverified IFrame can be added some some inputs, which could allow for a cross-site scripting attack. Versions 7.14.4 and 8.6.1 contain a fix for this…
- risk 0.28cvss 5.4epss 0.00
SuiteCRM is an open-source Customer Relationship Management (CRM) software application. In versions prior to 7.14.4 and 8.6.1, unchecked input allows for open re-direct. Versions 7.14.4 and 8.6.1 contain a fix for this issue.
- risk 0.28cvss 5.3epss 0.01
SuiteCRM 7.10.x prior to 7.10.21 and 7.11.x prior to 7.11.9 does not correctly implement the .htaccess protection mechanism.
- risk 0.28cvss 5.3epss 0.01
SuiteCRM 7.10.x before 7.10.20 and 7.11.x before 7.11.8 allows unintended public exposure of files.
Page 4 of 6