Sugarcrm
by Sugarcrm
CVEs (67)
| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2019-17299 | Hig | 0.47 | 7.2 | 0.01 | Oct 7, 2019 | SugarCRM before 8.0.4 and 9.x before 9.0.2 allows PHP code injection in the Administration module by an Admin user. | ||
| CVE-2019-17292 | Hig | 0.47 | 7.2 | 0.01 | Oct 7, 2019 | SugarCRM before 8.0.4 and 9.x before 9.0.2 allows SQL injection in the pmse_Inbox module by an Admin user. | ||
| CVE-2019-17317 | Hig | 0.47 | 7.2 | 0.01 | Oct 7, 2019 | SugarCRM before 8.0.4 and 9.x before 9.0.2 allows PHP object injection in the UpgradeWizard module by an Admin user. | ||
| CVE-2019-17315 | Hig | 0.47 | 7.2 | 0.01 | Oct 7, 2019 | SugarCRM before 8.0.4 and 9.x before 9.0.2 allows PHP object injection in the Administration module by an Admin user. | ||
| CVE-2019-14974 | Med | 0.45 | 6.1 | 0.28 | Aug 14, 2019 | SugarCRM Enterprise 9.0.0 allows mobile/error-not-supported-platform.html?desktop_url= XSS. | ||
| CVE-2018-17784 | Med | 0.43 | 6.1 | 0.04 | Oct 10, 2018 | Multiple vulnerabilities in YUI and FlashCanvas embedded in SugarCRM Community Edition 6.5.26 could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack on a targeted system. | ||
| CVE-2018-5715 | Med | 0.43 | 6.1 | 0.07 | Jan 16, 2018 | phprint.php in SugarCRM 3.5.1 has XSS via a parameter name in the query string (aka a $key variable). | ||
| CVE-2017-14510 | Med | 0.40 | 6.1 | 0.01 | Sep 17, 2017 | An issue was discovered in SugarCRM before 7.7.2.3, 7.8.x before 7.8.2.2, and 7.9.x before 7.9.2.0 (and Sugar Community Edition 6.5.26). The WebToLeadCapture functionality is found vulnerable to unauthenticated cross-site scripting (XSS) attacks. This attack vector is mitigated… | ||
| CVE-2020-36501 | Med | 0.35 | 5.4 | 0.01 | Oct 22, 2021 | Multiple cross-site scripting (XSS) vulnerabilities in the Support module of SugarCRM v6.5.18 allows attackers to execute arbitrary web scripts or HTML via crafted payloads entered into the primary address state or alternate address state input fields. | ||
| CVE-2020-28956 | Med | 0.35 | 5.4 | 0.01 | Oct 22, 2021 | Multiple cross-site scripting (XSS) vulnerabilities in the Sales module of SugarCRM v6.5.18 allows attackers to execute arbitrary web scripts or HTML via crafted payloads entered into the primary address state or alternate address state input fields. | ||
| CVE-2020-28955 | Med | 0.35 | 5.4 | 0.01 | Oct 22, 2021 | SugarCRM v6.5.18 was discovered to contain a cross-site scripting (XSS) vulnerability in the Create Employee module. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload in the First Name or Last Name input fields. | ||
| CVE-2020-17373 | Med | 0.35 | 5.3 | 0.01 | Aug 12, 2020 | SugarCRM before 10.1.0 (Q3 2020) allows SQL Injection. | ||
| CVE-2020-17372 | Med | 0.35 | 5.4 | 0.01 | Aug 12, 2020 | SugarCRM before 10.1.0 (Q3 2020) allows XSS. | ||
| CVE-2009-2146 | 0.05 | — | 0.21 | Jun 22, 2009 | Unrestricted file upload vulnerability in the Compose Email feature in the Emails module in Sugar Community Edition (aka SugarCRM) before 5.2f allows remote authenticated users to execute arbitrary code by uploading a file with only an extension in its name, then accessing the… | |||
| CVE-2011-0745 | 0.04 | — | 0.06 | Mar 16, 2011 | SugarCRM before 6.1.3 does not properly handle reloads and direct requests for a warning page produced by a certain duplicate check, which allows remote authenticated users to discover (1) the names of customers via a ShowDuplicates action to the Accounts module, reachable… | |||
| CVE-2006-2460 | 0.04 | — | 0.10 | May 19, 2006 | Sugar Suite Open Source (SugarCRM) 4.2 and earlier, when register_globals is enabled, does not protect critical variables such as $_GLOBALS and $_SESSION from modification, which allows remote attackers to conduct attacks such as directory traversal or PHP remote file inclusion,… | |||
| CVE-2011-4833 | 0.03 | — | 0.02 | Dec 15, 2011 | Multiple SQL injection vulnerabilities in the Leads module in SugarCRM 6.1 before 6.1.7, 6.2 before 6.2.4, 6.3 before 6.3.0RC3, and 6.4 before 6.4.0beta1 allow remote attackers to execute arbitrary SQL commands via the (1) where and (2) order parameters in a get_full_list action… | |||
| CVE-2008-2045 | 0.03 | — | 0.05 | May 1, 2008 | Absolute path traversal vulnerability in SugarCRM Sugar Community Edition 4.5.1 and 5.0.0 allows remote attackers to read arbitrary files via a full path in the URL parameter to modules/Feeds/Feed.php, which places the contents into a related cache file in the .cache/feeds… | |||
| CVE-2005-4087 | 0.03 | — | 0.04 | Dec 8, 2005 | PHP remote file include vulnerability in acceptDecline.php in Sugar Suite Open Source Customer Relationship Management (SugarCRM) 4.0 beta and earlier allows remote attackers to execute arbitrary PHP code via a URL in the beanFiles array parameter. | |||
| CVE-2004-1225 | 0.03 | — | 0.02 | Jan 10, 2005 | SQL injection vulnerability in SugarCRM Sugar Sales before 2.0.1a allows remote attackers to execute arbitrary SQL commands and gain privileges via the record parameter in a DetailView action to index.php, and record parameters in other functionality. |
- risk 0.47cvss 7.2epss 0.01
SugarCRM before 8.0.4 and 9.x before 9.0.2 allows PHP code injection in the Administration module by an Admin user.
- risk 0.47cvss 7.2epss 0.01
SugarCRM before 8.0.4 and 9.x before 9.0.2 allows SQL injection in the pmse_Inbox module by an Admin user.
- risk 0.47cvss 7.2epss 0.01
SugarCRM before 8.0.4 and 9.x before 9.0.2 allows PHP object injection in the UpgradeWizard module by an Admin user.
- risk 0.47cvss 7.2epss 0.01
SugarCRM before 8.0.4 and 9.x before 9.0.2 allows PHP object injection in the Administration module by an Admin user.
- risk 0.45cvss 6.1epss 0.28
SugarCRM Enterprise 9.0.0 allows mobile/error-not-supported-platform.html?desktop_url= XSS.
- risk 0.43cvss 6.1epss 0.04
Multiple vulnerabilities in YUI and FlashCanvas embedded in SugarCRM Community Edition 6.5.26 could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack on a targeted system.
- risk 0.43cvss 6.1epss 0.07
phprint.php in SugarCRM 3.5.1 has XSS via a parameter name in the query string (aka a $key variable).
- risk 0.40cvss 6.1epss 0.01
An issue was discovered in SugarCRM before 7.7.2.3, 7.8.x before 7.8.2.2, and 7.9.x before 7.9.2.0 (and Sugar Community Edition 6.5.26). The WebToLeadCapture functionality is found vulnerable to unauthenticated cross-site scripting (XSS) attacks. This attack vector is mitigated…
- risk 0.35cvss 5.4epss 0.01
Multiple cross-site scripting (XSS) vulnerabilities in the Support module of SugarCRM v6.5.18 allows attackers to execute arbitrary web scripts or HTML via crafted payloads entered into the primary address state or alternate address state input fields.
- risk 0.35cvss 5.4epss 0.01
Multiple cross-site scripting (XSS) vulnerabilities in the Sales module of SugarCRM v6.5.18 allows attackers to execute arbitrary web scripts or HTML via crafted payloads entered into the primary address state or alternate address state input fields.
- risk 0.35cvss 5.4epss 0.01
SugarCRM v6.5.18 was discovered to contain a cross-site scripting (XSS) vulnerability in the Create Employee module. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload in the First Name or Last Name input fields.
- risk 0.35cvss 5.3epss 0.01
SugarCRM before 10.1.0 (Q3 2020) allows SQL Injection.
- risk 0.35cvss 5.4epss 0.01
SugarCRM before 10.1.0 (Q3 2020) allows XSS.
- CVE-2009-2146Jun 22, 2009risk 0.05cvss —epss 0.21
Unrestricted file upload vulnerability in the Compose Email feature in the Emails module in Sugar Community Edition (aka SugarCRM) before 5.2f allows remote authenticated users to execute arbitrary code by uploading a file with only an extension in its name, then accessing the…
- CVE-2011-0745Mar 16, 2011risk 0.04cvss —epss 0.06
SugarCRM before 6.1.3 does not properly handle reloads and direct requests for a warning page produced by a certain duplicate check, which allows remote authenticated users to discover (1) the names of customers via a ShowDuplicates action to the Accounts module, reachable…
- CVE-2006-2460May 19, 2006risk 0.04cvss —epss 0.10
Sugar Suite Open Source (SugarCRM) 4.2 and earlier, when register_globals is enabled, does not protect critical variables such as $_GLOBALS and $_SESSION from modification, which allows remote attackers to conduct attacks such as directory traversal or PHP remote file inclusion,…
- CVE-2011-4833Dec 15, 2011risk 0.03cvss —epss 0.02
Multiple SQL injection vulnerabilities in the Leads module in SugarCRM 6.1 before 6.1.7, 6.2 before 6.2.4, 6.3 before 6.3.0RC3, and 6.4 before 6.4.0beta1 allow remote attackers to execute arbitrary SQL commands via the (1) where and (2) order parameters in a get_full_list action…
- CVE-2008-2045May 1, 2008risk 0.03cvss —epss 0.05
Absolute path traversal vulnerability in SugarCRM Sugar Community Edition 4.5.1 and 5.0.0 allows remote attackers to read arbitrary files via a full path in the URL parameter to modules/Feeds/Feed.php, which places the contents into a related cache file in the .cache/feeds…
- CVE-2005-4087Dec 8, 2005risk 0.03cvss —epss 0.04
PHP remote file include vulnerability in acceptDecline.php in Sugar Suite Open Source Customer Relationship Management (SugarCRM) 4.0 beta and earlier allows remote attackers to execute arbitrary PHP code via a URL in the beanFiles array parameter.
- CVE-2004-1225Jan 10, 2005risk 0.03cvss —epss 0.02
SQL injection vulnerability in SugarCRM Sugar Sales before 2.0.1a allows remote attackers to execute arbitrary SQL commands and gain privileges via the record parameter in a DetailView action to index.php, and record parameters in other functionality.
Page 3 of 4