CVE-2019-25664 | High | 7.1 | 2026-04-05 | SuiteCRM 7.10.7 contains a time-based SQL injection vulnerability in the record parameter of the Users module DetailView action that allows authenticated attac… |
CVE-2019-25663 | High | 7.1 | 2026-04-05 | SuiteCRM 7.10.7 contains a SQL injection vulnerability that allows authenticated attackers to manipulate database queries by injecting SQL code through the par… |
CVE-2025-64493 | Medium | 6.5 | 2025-11-08 | SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. In versions 8.6.0 through 8.9.0, there is an authenti… |
CVE-2025-64492 | High | 8.8 | 2025-11-08 | SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Versions 8.9.0 and below contain a time-based blind S… |
CVE-2025-64491 | Medium | 6.1 | 2025-11-08 | SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Versions 7.14.7 and below allow unauthenticated refle… |
CVE-2025-64490 | High | 8.3 | 2025-11-08 | SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Versions 7.14.7 and prior, 8.0.0-beta.1 through 8.9.0… |
CVE-2025-64489 | High | 8.3 | 2025-11-08 | SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Versions 7.14.7 and prior, 8.0.0-beta.1 through 8.9.0… |
CVE-2025-64488 | High | 8.8 | 2025-11-08 | SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. In versions 7.14.7 and below and 8.0.0-beta.1 through… |
CVE-2022-50590 | Medium | 5.3 | 2025-11-06 | SuiteCRM versions prior to 7.12.6 contain a type confusion vulnerability within the processing of the ‘module’ parameter within the ‘deleteAttachment’ function… |
CVE-2022-50589 | Critical | 9.8 | 2025-11-06 | SuiteCRM versions prior to 7.12.6 contain a SQL injection vulnerability within the processing of the ‘uid’ parameter within the ‘export’ functionality. Success… |
CVE-2025-41384 | Medium | 6.1 | 2025-10-27 | Cross-Site Scripting (XSS) vulnerability reflected in SuiteCRM v7.14.1. This vulnerability allows an attacker to execute JavaScript code by modifying the HTTP… |
CVE-2025-54787 | Low | 3.7 | 2025-08-07 | SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. There is a vulnerability in SuiteCRM version 7.14.6 w… |
CVE-2025-54784 | Medium | 6.1 | 2025-08-07 | SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. There is a Cross Site Scripting (XSS) vulnerability i… |
CVE-2025-54783 | Medium | 6.1 | 2025-08-07 | SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Versions 7.14.6 and below have a Reflected Cross-Site… |
CVE-2025-54788 | High | 8.8 | 2025-08-07 | SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. In versions and below, the InboundEmail module allows… |
CVE-2025-54786 | Medium | 5.3 | 2025-08-07 | SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. In versions 7.14.6 and 8.8.0, the broken authenticati… |
CVE-2025-54785 | High | 8.8 | 2025-08-07 | SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. In versions 7.14.6 and 8.8.0, user-supplied input is… |
CVE-2022-45186 | High | 8.1 | 2025-01-07 | An issue was discovered in SuiteCRM 7.12.7. Authenticated users can recover an arbitrary field of a database. |
CVE-2022-45185 | High | 8.8 | 2025-01-07 | An issue was discovered in SuiteCRM 7.12.7. Authenticated users can use CRM functions to upload malicious files. Then, deserialization can be used to achieve c… |
CVE-2024-50335 | Medium | 4.9 | 2024-11-05 | SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. The "Publish Key" field in SuiteCRM's Edit Profile pa… |
CVE-2024-50333 | Medium | 6.6 | 2024-11-05 | SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. User input is not validated and is written to the fil… |
CVE-2024-50332 | High | 8.8 | 2024-11-05 | SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Insufficient input value validation causes Blind SQL… |
CVE-2024-49774 | High | 7.2 | 2024-11-05 | SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. SuiteCRM relies on the blacklist of functions/methods… |
CVE-2024-49773 | Medium | 5.3 | 2024-11-05 | SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Poor input validation in export allows authenticated… |
CVE-2024-49772 | High | 8.8 | 2024-11-05 | SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. In SuiteCRM versions 7.14.4, poor input validation al… |
CVE-2024-45392 | High | 7.7 | 2024-09-05 | SuiteCRM is an open-source customer relationship management (CRM) system. Prior to version 7.14.5 and 8.6.2, insufficient access control checks allow a threat… |
CVE-2024-36419 | Medium | 4.3 | 2024-06-10 | SuiteCRM is an open-source Customer Relationship Management (CRM) software application. A vulnerability in versions prior to 8.6.1 allows for Host Header Injec… |
CVE-2024-36418 | High | 8.5 | 2024-06-10 | SuiteCRM is an open-source Customer Relationship Management (CRM) software application. Prior to versions 7.14.4 and 8.6.1, a vulnerability in connectors allow… |
CVE-2024-36417 | Medium | 5.7 | 2024-06-10 | SuiteCRM is an open-source Customer Relationship Management (CRM) software application. Prior to versions 7.14.4 and 8.6.1, an unverified IFrame can be added s… |
CVE-2024-36416 | High | 8.6 | 2024-06-10 | SuiteCRM is an open-source Customer Relationship Management (CRM) software application. Prior to versions 7.14.4 and 8.6.1, a deprecated v4 API example with no… |
CVE-2024-36415 | Critical | 9.1 | 2024-06-10 | SuiteCRM is an open-source Customer Relationship Management (CRM) software application. Prior to versions 7.14.4 and 8.6.1, a vulnerability in uploaded file ve… |
CVE-2024-36414 | High | 7.7 | 2024-06-10 | SuiteCRM is an open-source Customer Relationship Management (CRM) software application. Prior to versions 7.14.4 and 8.6.1, a vulnerability in the connectors f… |
CVE-2024-36413 | High | 8.9 | 2024-06-10 | SuiteCRM is an open-source Customer Relationship Management (CRM) software application. Prior to versions 7.14.4 and 8.6.1, a vulnerability in the import modul… |
CVE-2024-36412 | Critical | 10.0 | 2024-06-10 | SuiteCRM is an open-source Customer Relationship Management (CRM) software application. Prior to versions 7.14.4 and 8.6.1, a vulnerability in events response… |
CVE-2024-36411 | Critical | 9.6 | 2024-06-10 | SuiteCRM is an open-source Customer Relationship Management (CRM) software application. In versions prior to 7.14.4 and 8.6.1, poor input validation allows for… |
CVE-2024-36410 | Critical | 9.6 | 2024-06-10 | SuiteCRM is an open-source Customer Relationship Management (CRM) software application. In versions prior to 7.14.4 and 8.6.1, poor input validation allows for… |
CVE-2024-36409 | Critical | 9.6 | 2024-06-10 | SuiteCRM is an open-source Customer Relationship Management (CRM) software application. In versions prior to 7.14.4 and 8.6.1, poor input validation allows for… |
CVE-2024-36408 | Critical | 9.6 | 2024-06-10 | SuiteCRM is an open-source Customer Relationship Management (CRM) software application. In versions prior to 7.14.4 and 8.6.1, poor input validation allows for… |
CVE-2024-36407 | Low | 3.7 | 2024-06-10 | SuiteCRM is an open-source Customer Relationship Management (CRM) software application. In versions prior to 7.14.4 and 8.6.1, a user password can be reset fro… |
CVE-2024-36406 | Medium | 5.4 | 2024-06-10 | SuiteCRM is an open-source Customer Relationship Management (CRM) software application. In versions prior to 7.14.4 and 8.6.1, unchecked input allows for open… |
CVE-2024-1644 | Critical | 9.9 | 2024-02-20 | Suite CRM version 7.14.2 allows including local php files. This is possible
because the application is vulnerable to LFI.
|
CVE-2023-6388 | Medium | 5.0 | 2024-02-07 | Suite CRM version 7.14.2 allows making arbitrary HTTP requests through
the vulnerable server. This is possible because the application is vulnerable
to SSRF. |
CVE-2023-47643 | Low | 3.1 | 2023-11-21 | SuiteCRM is a Customer Relationship Management (CRM) software application. Prior to version 8.4.2, Graphql Introspection is enabled without authentication, exp… |
CVE-2023-6131 | High | 8.8 | 2023-11-14 | Code Injection in GitHub repository salesagility/suitecrm prior to 7.14.2, 7.12.14, 8.4.2. |
CVE-2023-6130 | High | 8.8 | 2023-11-14 | Path Traversal: '\..\filename' in GitHub repository salesagility/suitecrm prior to 7.14.2, 7.12.14, 8.4.2. |
CVE-2023-6128 | Medium | 5.4 | 2023-11-14 | Cross-site Scripting (XSS) - Reflected in GitHub repository salesagility/suitecrm prior to 7.14.2, 7.12.14, 8.4.2. |
CVE-2023-6127 | Medium | 5.4 | 2023-11-14 | Unrestricted Upload of File with Dangerous Type in GitHub repository salesagility/suitecrm prior to 7.14.2, 7.12.14, 8.4.2. |
CVE-2023-6126 | Critical | 9.8 | 2023-11-14 | Code Injection in GitHub repository salesagility/suitecrm prior to 7.14.2, 7.12.14, 8.4.2. |
CVE-2023-6125 | High | 8.8 | 2023-11-14 | Code Injection in GitHub repository salesagility/suitecrm prior to 7.14.2, 7.12.14, 8.4.2. |
CVE-2023-6124 | Medium | 4.3 | 2023-11-14 | Server-Side Request Forgery (SSRF) in GitHub repository salesagility/suitecrm prior to 7.14.2, 8.4.2, 7.12.14. |
CVE-2023-5353 | Medium | 6.5 | 2023-10-03 | Improper Access Control in GitHub repository salesagility/suitecrm prior to 7.14.1. |
CVE-2023-5351 | Medium | 5.4 | 2023-10-03 | Cross-site Scripting (XSS) - Stored in GitHub repository salesagility/suitecrm prior to 7.14.1. |
CVE-2023-5350 | Critical | 9.1 | 2023-10-03 | SQL Injection in GitHub repository salesagility/suitecrm prior to 7.14.1. |
CVE-2023-3627 | High | 8.8 | 2023-07-11 | Cross-Site Request Forgery (CSRF) in GitHub repository salesagility/suitecrm-core prior to 8.3.1. |
CVE-2023-3293 | Medium | 4.8 | 2023-06-16 | Cross-site Scripting (XSS) - Stored in GitHub repository salesagility/suitecrm-core prior to 8.3.0. |
CVE-2023-1034 | High | 8.8 | 2023-02-25 | Path Traversal: '\..\filename' in GitHub repository salesagility/suitecrm prior to 7.12.9. |
CVE-2022-27474 | High | 7.2 | 2022-04-15 | SuiteCRM v7.11.23 was discovered to allow remote code execution via a crafted payload injected into the FirstName text field. |
CVE-2022-23940 | High | 8.8 | 2022-03-10 | SuiteCRM through 7.12.1 and 8.x through 8.0.1 allows Remote Code Execution. Authenticated users with access to the Scheduled Reports module can achieve this by… |
CVE-2022-0756 | Medium | 6.5 | 2022-03-07 | Missing Authorization in GitHub repository salesagility/suitecrm prior to 7.12.5. |
CVE-2022-0755 | Medium | 4.3 | 2022-03-07 | Missing Authorization in GitHub repository salesagility/suitecrm prior to 7.12.5. |
CVE-2022-0754 | Medium | 6.5 | 2022-03-07 | SQL Injection in GitHub repository salesagility/suitecrm prior to 7.12.5. |
CVE-2021-45899 | Critical | 9.8 | 2022-01-28 | SuiteCRM before 7.12.3 and 8.x before 8.0.2 allows PHAR deserialization that can lead to remote code execution. |
CVE-2021-45898 | Critical | 9.8 | 2022-01-28 | SuiteCRM before 7.12.3 and 8.x before 8.0.2 allows local file inclusion. |
CVE-2021-45897 | High | 8.8 | 2022-01-28 | SuiteCRM before 7.12.3 and 8.x before 8.0.2 allows remote code execution. |
CVE-2021-41597 | High | 8.8 | 2022-01-12 | SuiteCRM through 7.11.21 is vulnerable to CSRF, with resultant remote code execution, via the UpgradeWizard functionality, if a PHP file is included in a ZIP a… |
CVE-2021-45903 | Medium | 6.1 | 2021-12-28 | A persistent cross-site scripting (XSS) issue in the web interface of SuiteCRM before 7.10.35, and 7.11.x and 7.12.x before 7.12.2, allows a remote attacker to… |
CVE-2021-45041 | High | 8.8 | 2021-12-19 | SuiteCRM before 7.12.2 and 8.x before 8.0.1 allows authenticated SQL injection via the Tooltips action in the Project module, involving resource_id and start_d… |
CVE-2021-42840 | High | 8.8 | 2021-10-22 | SuiteCRM before 7.11.19 allows remote code execution via the system settings Log File Name setting. In certain circumstances involving admin account takeover… |
CVE-2021-41596 | Medium | 5.3 | 2021-10-04 | SuiteCRM before 7.10.33 and 7.11.22 allows information disclosure via Directory Traversal. An attacker can partially include arbitrary files via the importFile… |
CVE-2021-41595 | Medium | 5.3 | 2021-10-04 | SuiteCRM before 7.10.33 and 7.11.22 allows information disclosure via Directory Traversal. An attacker can partially include arbitrary files via the file_name… |
CVE-2021-41869 | High | 8.8 | 2021-10-04 | SuiteCRM 7.10.x before 7.10.33 and 7.11.x before 7.11.22 is vulnerable to privilege escalation. |
CVE-2021-25961 | High | 8.0 | 2021-09-29 | In “SuiteCRM” application, v7.1.7 through v7.10.31 and v7.11-beta through v7.11.20 fail to properly invalidate password reset links that is associated with a d… |
CVE-2021-25960 | High | 8.0 | 2021-09-29 | In “SuiteCRM” application, v7.11.18 through v7.11.19 and v7.10.29 through v7.10.31 are affected by “CSV Injection” vulnerability (Formula Injection). A low pri… |
CVE-2021-39268 | Medium | 6.1 | 2021-08-18 | Persistent cross-site scripting (XSS) in the web interface of SuiteCRM before 7.11.19 allows a remote attacker to introduce arbitrary JavaScript via malicious… |
CVE-2021-39267 | Medium | 6.1 | 2021-08-18 | Persistent cross-site scripting (XSS) in the web interface of SuiteCRM before 7.11.19 allows a remote attacker to introduce arbitrary JavaScript via a Content-… |
CVE-2021-31792 | Medium | 5.4 | 2021-04-30 | XSS in the client account page in SuiteCRM before 7.11.19 allows an attacker to inject JavaScript via the name field |
CVE-2020-15300 | Medium | 6.1 | 2020-11-18 | SuiteCRM through 7.11.13 has an Open Redirect in the Documents module via a crafted SVG document. |
CVE-2020-14208 | Medium | 5.4 | 2020-11-18 | SuiteCRM 7.11.13 is affected by stored Cross-Site Scripting (XSS) in the Documents preview functionality. This vulnerability could allow remote authenticated a… |
CVE-2020-15301 | High | 7.8 | 2020-11-18 | SuiteCRM through 7.11.13 allows CSV Injection via registration fields in the Accounts, Contacts, Opportunities, and Leads modules. These fields are mishandled… |
CVE-2020-28328 | High | 8.8 | 2020-11-06 | SuiteCRM before 7.11.17 is vulnerable to remote code execution via the system settings Log File Name setting. In certain circumstances involving admin account… |
CVE-2019-18782 | Medium | 5.3 | 2020-03-20 | SuiteCRM 7.10.x prior to 7.10.21 and 7.11.x prior to 7.11.9 does not correctly implement the .htaccess protection mechanism. |
CVE-2020-8787 | High | 7.5 | 2020-03-16 | SuiteCRM 7.10.x versions prior to 7.10.23 and 7.11.x versions prior to 7.11.11 allow for an invalid Bean ID to be submitted. |
CVE-2020-8786 | Critical | 9.8 | 2020-03-16 | SuiteCRM 7.10.x versions prior to 7.10.23 and 7.11.x versions prior to 7.11.11 allow SQL Injection (issue 4 of 4). |
CVE-2020-8785 | Critical | 9.8 | 2020-03-16 | SuiteCRM 7.10.x versions prior to 7.10.23 and 7.11.x versions prior to 7.11.11 allow SQL Injection (issue 3 of 4). |
CVE-2020-8784 | Critical | 9.8 | 2020-03-16 | SuiteCRM 7.10.x versions prior to 7.10.23 and 7.11.x versions prior to 7.11.11 allow SQL Injection (issue 2 of 4). |
CVE-2020-8783 | Critical | 9.8 | 2020-03-16 | SuiteCRM 7.10.x versions prior to 7.10.23 and 7.11.x versions prior to 7.11.11 allow SQL Injection (issue 1 of 4). |
CVE-2020-8804 | Medium | 6.5 | 2020-02-13 | SuiteCRM through 7.11.10 allows SQL Injection via the SOAP API, the EmailUIAjax interface, or the MailMerge module. |
CVE-2020-8803 | Critical | 9.8 | 2020-02-13 | SuiteCRM through 7.11.11 allows Directory Traversal to include arbitrary .php files within the webroot via add_to_prospect_list. |
CVE-2020-8802 | Critical | 9.8 | 2020-02-13 | SuiteCRM through 7.11.11 has Incorrect Access Control via action_saveHTMLField Bean Manipulation. |
CVE-2020-8801 | High | 7.2 | 2020-02-13 | SuiteCRM through 7.11.11 allows PHAR Deserialization. |
CVE-2020-8800 | High | 8.8 | 2020-02-13 | SuiteCRM through 7.11.11 allows EmailsControllerActionGetFromFields PHP Object Injection. |
CVE-2019-18784 | Critical | 9.8 | 2019-11-06 | SuiteCRM 7.10.x versions prior to 7.10.21 and 7.11.x versions prior to 7.11.9 allow SQL Injection. |
CVE-2019-14454 | Critical | 9.8 | 2019-10-02 | SuiteCRM 7.11.x and 7.10.x before 7.11.8 and 7.10.20 is vulnerable to vertical privilege escalation. |
CVE-2019-13335 | Critical | 9.8 | 2019-10-02 | SalesAgility SuiteCRM 7.10.x 7.10.19 and 7.11.x before and 7.11.7 has SSRF. |
CVE-2019-14752 | Medium | 6.1 | 2019-09-30 | SuiteCRM 7.10.x and 7.11.x before 7.10.20 and 7.11.8 has XSS. |
CVE-2019-16922 | Medium | 5.3 | 2019-09-27 | SuiteCRM 7.10.x before 7.10.20 and 7.11.x before 7.11.8 allows unintended public exposure of files. |
CVE-2019-12601 | Critical | 9.8 | 2019-06-07 | SuiteCRM 7.8.x before 7.8.30, 7.10.x before 7.10.17, and 7.11.x before 7.11.5 allows SQL Injection (issue 3 of 3). |
CVE-2019-12600 | Critical | 9.8 | 2019-06-07 | SuiteCRM 7.8.x before 7.8.30, 7.10.x before 7.10.17, and 7.11.x before 7.11.5 allows SQL Injection (issue 2 of 3). |
CVE-2019-12599 | Critical | 9.8 | 2019-06-07 | SuiteCRM 7.10.x before 7.10.17 and 7.11.x before 7.11.5 allows SQL Injection. |
CVE-2019-12598 | Critical | 9.8 | 2019-06-07 | SuiteCRM 7.8.x before 7.8.30, 7.10.x before 7.10.17, and 7.11.x before 7.11.5 allows SQL Injection (issue 1 of 3). |