Skip to content
OpenAdvisories

Vendor

salesagility

40 known vulnerabilities.

Products

SuiteCRM 22 salesagility/suitecrm 14 salesagility/suitecrm-core 2 SuiteCRM-Core 2
All Critical High Medium Low Exploited only Public exploit

18 results · Clear filters · Feed

  • High 8.8
    CVE-2024-50332

    Authenticated Blind SQL Injection in DeleteRelationShip in SuiteCRM

    SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Insufficient input value validation causes Blind SQL injection in DeleteRelationShip. This issue has been addressed in versions 7.14.6 and 8.7.1. Users a…

    salesagility SuiteCRM
  • High 7.2
    CVE-2024-49774

    ModuleScanner flaws in SuiteCRM

    SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. SuiteCRM relies on the blacklist of functions/methods to prevent installation of malicious MLPs. But this checks can be bypassed with some syntax constru…

    salesagility SuiteCRM
  • High 8.8
    CVE-2024-49772

    Authenticated SQL injection in AM_ProjectTemplates controller in SuiteCRM

    SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. In SuiteCRM versions 7.14.4, poor input validation allows authenticated user do a SQL injection attack. Authenticated user with low pivilege can leak all…

    salesagility SuiteCRM
  • High 7.7
    CVE-2024-45392

    SuiteCRM has wrong deletion permission checks on API delete call

    SuiteCRM is an open-source customer relationship management (CRM) system. Prior to version 7.14.5 and 8.6.2, insufficient access control checks allow a threat actor to delete records via the API. Versions 7.14.5 and 8.6.2 contain a patch for the issue.

    salesagility SuiteCRM
  • High 8.6
    CVE-2024-36418

    SuiteCRM authenticated RCE using connectors

    SuiteCRM is an open-source Customer Relationship Management (CRM) software application. Prior to versions 7.14.4 and 8.6.1, a vulnerability in connectors allows an authenticated user to perform a remote code execution attack. Versions 7.14.4 and 8.6.1 contain…

    salesagility SuiteCRM
  • High 8.6
    CVE-2024-36416 Public exploit

    SuiteCRM v4 API Excessive log data DOS

    SuiteCRM is an open-source Customer Relationship Management (CRM) software application. Prior to versions 7.14.4 and 8.6.1, a deprecated v4 API example with no log rotation allows denial of service by logging excessive data. Versions 7.14.4 and 8.6.1 contain …

    salesagility SuiteCRM
  • High 7.7
    CVE-2024-36414

    SuiteCRM authenticated Server-Side Request Forgery

    SuiteCRM is an open-source Customer Relationship Management (CRM) software application. Prior to versions 7.14.4 and 8.6.1, a vulnerability in the connectors file verification allows for a server-side request forgery attack. Versions 7.14.4 and 8.6.1 contain …

    salesagility SuiteCRM
  • High 8.9
    CVE-2024-36413

    SuiteCRM authenticated Reflected Cross-Site Scripting

    SuiteCRM is an open-source Customer Relationship Management (CRM) software application. Prior to versions 7.14.4 and 8.6.1, a vulnerability in the import module error view allows for a cross-site scripting attack. Versions 7.14.4 and 8.6.1 contain a fix for t…

    salesagility SuiteCRM
  • High 7.2
    CVE-2023-6131

    Code Injection in salesagility/suitecrm

    Code Injection in GitHub repository salesagility/suitecrm prior to 7.14.2, 7.12.14, 8.4.2.

    salesagility salesagility/suitecrm
  • High 7.5
    CVE-2023-6130

    Path Traversal: '\..\filename' in salesagility/suitecrm

    Path Traversal: '\..\filename' in GitHub repository salesagility/suitecrm prior to 7.14.2, 7.12.14, 8.4.2.

    salesagility salesagility/suitecrm
  • High 8.1
    CVE-2023-5353

    Improper Access Control in salesagility/suitecrm

    Improper Access Control in GitHub repository salesagility/suitecrm prior to 7.14.1.

    salesagility salesagility/suitecrm
  • High 8.9
    CVE-2023-5351

    Cross-site Scripting (XSS) - Stored in salesagility/suitecrm

    Cross-site Scripting (XSS) - Stored in GitHub repository salesagility/suitecrm prior to 7.14.1.

    salesagility salesagility/suitecrm
  • High 8.1
    CVE-2023-3627

    Cross-Site Request Forgery (CSRF) in salesagility/suitecrm-core

    Cross-Site Request Forgery (CSRF) in GitHub repository salesagility/suitecrm-core prior to 8.3.1.

    salesagility salesagility/suitecrm-core
  • High 7.6
    CVE-2023-3293

    Cross-site Scripting (XSS) - Stored in salesagility/suitecrm-core

    Cross-site Scripting (XSS) - Stored in GitHub repository salesagility/suitecrm-core prior to 8.3.0.

    salesagility salesagility/suitecrm-core
  • High 7.1
    CVE-2022-0754

    SQL Injection in salesagility/suitecrm

    SQL Injection in GitHub repository salesagility/suitecrm prior to 7.12.5.

    salesagility salesagility/suitecrm
  • High 7.1
    CVE-2022-0755

    Missing Authorization in salesagility/suitecrm

    Missing Authorization in GitHub repository salesagility/suitecrm prior to 7.12.5.

    salesagility salesagility/suitecrm
  • High 8.0
    CVE-2021-25960

    SuiteCRM - CSV Injection in Accounts Module

    In “SuiteCRM” application, v7.11.18 through v7.11.19 and v7.10.29 through v7.10.31 are affected by “CSV Injection” vulnerability (Formula Injection). A low privileged attacker can use accounts module to inject payloads in the input fields. When an administrat…

    salesagility SuiteCRM
  • High 8.0
    CVE-2021-25961

    SuiteCRM - Account Takeover in Password Reset Functionality

    In “SuiteCRM” application, v7.1.7 through v7.10.31 and v7.11-beta through v7.11.20 fail to properly invalidate password reset links that is associated with a deleted user id, which makes it possible for account takeover of any newly created user with the same…

    salesagility SuiteCRM