CVE-2024-58258 | High | 7.2 | 2025-07-13 | SugarCRM before 13.0.4 and 14.x before 14.0.1 allows SSRF in the API module because a limited type of code injection can occur. |
CVE-2025-25034 | | | 2025-06-20 | A PHP object injection vulnerability exists in SugarCRM versions prior to 6.5.24, 6.7.13, 7.5.2.5, 7.6.2.2, and 7.7.1.0 due to improper validation of PHP seria… |
CVE-2023-46816 | High | 8.8 | 2023-10-27 | An issue was discovered in SugarCRM 12 before 12.0.4 and 13 before 13.0.2. A Server Site Template Injection (SSTI) vulnerability has been identified in the Gec… |
CVE-2023-46815 | High | 8.8 | 2023-10-27 | An issue was discovered in SugarCRM 12 before 12.0.4 and 13 before 13.0.2. An Unrestricted File Upload vulnerability has been identified in the Notes module. B… |
CVE-2023-35811 | High | 8.8 | 2023-06-17 | An issue was discovered in SugarCRM Enterprise before 11.0.6 and 12.x before 12.0.3. Two SQL Injection vectors have been identified in the REST API. By using c… |
CVE-2023-35810 | High | 7.2 | 2023-06-17 | An issue was discovered in SugarCRM Enterprise before 11.0.6 and 12.x before 12.0.3. A Second-Order PHP Object Injection vulnerability has been identified in t… |
CVE-2023-35809 | High | 8.8 | 2023-06-17 | An issue was discovered in SugarCRM Enterprise before 11.0.6 and 12.x before 12.0.3. A Bean Manipulation vulnerability has been identified in the REST API. By… |
CVE-2023-35808 | High | 8.8 | 2023-06-17 | An issue was discovered in SugarCRM Enterprise before 11.0.6 and 12.x before 12.0.3. An Unrestricted File Upload vulnerability has been identified in the Notes… |
CVE-2023-22952 | High | 8.8 | 2023-01-11 | In SugarCRM before 12.0. Hotfix 91155, a crafted request can inject custom PHP code through the EmailTemplates because of missing input validation. |
CVE-2020-36501 | Medium | 5.4 | 2021-10-22 | Multiple cross-site scripting (XSS) vulnerabilities in the Support module of SugarCRM v6.5.18 allows attackers to execute arbitrary web scripts or HTML via cra… |
CVE-2020-28956 | Medium | 5.4 | 2021-10-22 | Multiple cross-site scripting (XSS) vulnerabilities in the Sales module of SugarCRM v6.5.18 allows attackers to execute arbitrary web scripts or HTML via craft… |
CVE-2020-28955 | Medium | 5.4 | 2021-10-22 | SugarCRM v6.5.18 was discovered to contain a cross-site scripting (XSS) vulnerability in the Create Employee module. This vulnerability allows attackers to exe… |
CVE-2020-7472 | Critical | 9.8 | 2020-11-12 | An authorization bypass and PHP local-file-include vulnerability in the installation component of SugarCRM before 8.0, 8.0 before 8.0.7, 9.0 before 9.0.4, and… |
CVE-2020-17373 | Medium | 5.3 | 2020-08-12 | SugarCRM before 10.1.0 (Q3 2020) allows SQL Injection. |
CVE-2020-17372 | Medium | 5.4 | 2020-08-12 | SugarCRM before 10.1.0 (Q3 2020) allows XSS. |
CVE-2012-0694 | Critical | 9.8 | 2019-10-29 | SugarCRM CE <= 6.3.1 contains scripts that use "unserialize()" with user controlled input which allows remote attackers to execute arbitrary PHP code. |
CVE-2019-17314 | High | 7.2 | 2019-10-07 | SugarCRM before 8.0.4 and 9.x before 9.0.2 allows directory traversal in the Configurator module by an Admin user. |
CVE-2019-17313 | High | 8.8 | 2019-10-07 | SugarCRM before 8.0.4 and 9.x before 9.0.2 allows directory traversal in the Studio module by a Developer user. |
CVE-2019-17312 | High | 8.8 | 2019-10-07 | SugarCRM before 8.0.4 and 9.x before 9.0.2 allows directory traversal in the file function by a Regular user. |
CVE-2019-17311 | High | 8.8 | 2019-10-07 | SugarCRM before 8.0.4 and 9.x before 9.0.2 allows directory traversal in the attachment function by a Regular user. |
CVE-2019-17310 | High | 7.2 | 2019-10-07 | SugarCRM before 8.0.4 and 9.x before 9.0.2 allows PHP code injection in the Campaigns module by an Admin user. |
CVE-2019-17309 | High | 7.2 | 2019-10-07 | SugarCRM before 8.0.4 and 9.x before 9.0.2 allows PHP code injection in the EmailMan module by an Admin user. |
CVE-2019-17308 | High | 8.8 | 2019-10-07 | SugarCRM before 8.0.4 and 9.x before 9.0.2 allows PHP code injection in the Emails module by a Regular user. |
CVE-2019-17307 | High | 7.2 | 2019-10-07 | SugarCRM before 8.0.4 and 9.x before 9.0.2 allows PHP code injection in the Tracker module by an Admin user. |
CVE-2019-17306 | High | 7.2 | 2019-10-07 | SugarCRM before 8.0.4 and 9.x before 9.0.2 allows PHP code injection in the Configurator module by an Admin user. |
CVE-2019-17305 | High | 8.8 | 2019-10-07 | SugarCRM before 8.0.4 and 9.x before 9.0.2 allows PHP code injection in the MergeRecords module by a Regular user. |
CVE-2019-17304 | High | 7.2 | 2019-10-07 | SugarCRM before 8.0.4 and 9.x before 9.0.2 allows PHP code injection in the MergeRecords module by an Admin user. |
CVE-2019-17303 | High | 8.8 | 2019-10-07 | SugarCRM before 8.0.4 and 9.x before 9.0.2 allows PHP code injection in the MergeRecords module by a Developer user. |
CVE-2019-17302 | High | 8.8 | 2019-10-07 | SugarCRM before 8.0.4 and 9.x before 9.0.2 allows PHP code injection in the ModuleBuilder module by a Developer user. |
CVE-2019-17301 | High | 7.2 | 2019-10-07 | SugarCRM before 8.0.4 and 9.x before 9.0.2 allows PHP code injection in the ModuleBuilder module by an Admin user. |
CVE-2019-17300 | High | 8.8 | 2019-10-07 | SugarCRM before 8.0.4 and 9.x before 9.0.2 allows PHP code injection in the Administration module by a Developer user. |
CVE-2019-17299 | High | 7.2 | 2019-10-07 | SugarCRM before 8.0.4 and 9.x before 9.0.2 allows PHP code injection in the Administration module by an Admin user. |
CVE-2019-17298 | High | 8.8 | 2019-10-07 | SugarCRM before 8.0.4 and 9.x before 9.0.2 allows SQL injection in the Administration module by a Developer user. |
CVE-2019-17297 | High | 8.8 | 2019-10-07 | SugarCRM before 8.0.4 and 9.x before 9.0.2 allows SQL injection in the Quotes module by a Regular user. |
CVE-2019-17296 | High | 8.8 | 2019-10-07 | SugarCRM before 8.0.4 and 9.x before 9.0.2 allows SQL injection in the Contacts module by a Regular user. |
CVE-2019-17295 | High | 8.8 | 2019-10-07 | SugarCRM before 8.0.4 and 9.x before 9.0.2 allows SQL injection in the history function by a Regular user. |
CVE-2019-17294 | High | 8.8 | 2019-10-07 | SugarCRM before 8.0.4 and 9.x before 9.0.2 allows SQL injection in the export function by a Regular user. |
CVE-2019-17293 | High | 8.8 | 2019-10-07 | SugarCRM before 8.0.4 and 9.x before 9.0.2 allows SQL injection in the pmse_Project module by a Regular user. |
CVE-2019-17292 | High | 7.2 | 2019-10-07 | SugarCRM before 8.0.4 and 9.x before 9.0.2 allows SQL injection in the pmse_Inbox module by an Admin user. |
CVE-2019-17319 | High | 8.8 | 2019-10-07 | SugarCRM before 8.0.4 and 9.x before 9.0.2 allows SQL injection in the Emails module by a Regular user. |
CVE-2019-17318 | High | 8.8 | 2019-10-07 | SugarCRM before 8.0.4 and 9.x before 9.0.2 allows SQL injection in the pmse_Inbox module by a Regular user. |
CVE-2019-17317 | High | 7.2 | 2019-10-07 | SugarCRM before 8.0.4 and 9.x before 9.0.2 allows PHP object injection in the UpgradeWizard module by an Admin user. |
CVE-2019-17316 | High | 8.8 | 2019-10-07 | SugarCRM before 8.0.4 and 9.x before 9.0.2 allows PHP object injection in the Import module by a Regular user. |
CVE-2019-17315 | High | 7.2 | 2019-10-07 | SugarCRM before 8.0.4 and 9.x before 9.0.2 allows PHP object injection in the Administration module by an Admin user. |
CVE-2019-14974 | Medium | 6.1 | 2019-08-14 | SugarCRM Enterprise 9.0.0 allows mobile/error-not-supported-platform.html?desktop_url= XSS. |
CVE-2018-17784 | Medium | 6.1 | 2018-10-10 | Multiple vulnerabilities in YUI and FlashCanvas embedded in SugarCRM Community Edition 6.5.26 could allow an unauthenticated, remote attacker to conduct a cros… |
CVE-2014-3244 | Critical | 9.8 | 2018-02-01 | XML external entity (XXE) vulnerability in the RSSDashlet dashlet in SugarCRM before 6.5.17 allows remote attackers to read arbitrary files or potentially exec… |
CVE-2018-6308 | Critical | 9.8 | 2018-01-25 | Multiple SQL injections exist in SugarCRM Community Edition 6.5.26 and below via the track parameter to modules\Campaigns\Tracker.php and modules\Campaigns\uti… |
CVE-2018-5715 | Medium | 6.1 | 2018-01-16 | phprint.php in SugarCRM 3.5.1 has XSS via a parameter name in the query string (aka a $key variable). |
CVE-2017-14510 | Medium | 6.1 | 2017-09-17 | An issue was discovered in SugarCRM before 7.7.2.3, 7.8.x before 7.8.2.2, and 7.9.x before 7.9.2.0 (and Sugar Community Edition 6.5.26). The WebToLeadCapture f… |
CVE-2017-14509 | High | 8.8 | 2017-09-17 | An issue was discovered in SugarCRM before 7.7.2.3, 7.8.x before 7.8.2.2, and 7.9.x before 7.9.2.0 (and Sugar Community Edition 6.5.26). A remote file inclusio… |
CVE-2017-14508 | High | 8.8 | 2017-09-17 | An issue was discovered in SugarCRM before 7.7.2.3, 7.8.x before 7.8.2.2, and 7.9.x before 7.9.2.0 (and Sugar Community Edition 6.5.26). Several areas have bee… |
CVE-2015-5946 | High | 7.8 | 2017-08-07 | Incomplete blacklist vulnerability in SuiteCRM 7.2.2 allows remote authenticated users to execute arbitrary code by uploading a file with an executable extensi… |
CVE-2011-4833 | | | 2011-12-15 | Multiple SQL injection vulnerabilities in the Leads module in SugarCRM 6.1 before 6.1.7, 6.2 before 6.2.4, 6.3 before 6.3.0RC3, and 6.4 before 6.4.0beta1 allow… |
CVE-2011-3803 | | | 2011-09-24 | SugarCRM 6.1.0 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error mes… |
CVE-2011-0745 | | | 2011-03-16 | SugarCRM before 6.1.3 does not properly handle reloads and direct requests for a warning page produced by a certain duplicate check, which allows remote authen… |
CVE-2010-0465 | | | 2010-03-19 | Cross-site scripting (XSS) vulnerability in the online Documents functionality in SugarCRM 5.2.x before 5.2.0l and 5.5.x before 5.5.0a allows remote authentica… |
CVE-2009-2978 | | | 2009-08-27 | SQL injection vulnerability in SugarCRM 4.5.1o and earlier, 5.0.0k and earlier, and 5.2.0g and earlier, allows remote attackers to execute arbitrary SQL comman… |
CVE-2009-2146 | | | 2009-06-22 | Unrestricted file upload vulnerability in the Compose Email feature in the Emails module in Sugar Community Edition (aka SugarCRM) before 5.2f allows remote au… |
CVE-2008-2045 | | | 2008-05-01 | Absolute path traversal vulnerability in SugarCRM Sugar Community Edition 4.5.1 and 5.0.0 allows remote attackers to read arbitrary files via a full path in th… |
CVE-2006-6712 | | | 2006-12-23 | Cross-site scripting (XSS) vulnerability in SugarCRM Open Source 4.5.0f and earlier allows remote attackers to inject arbitrary web script or HTML via unspecif… |
CVE-2006-5082 | | | 2006-09-29 | Unspecified vulnerability in Sugar Suite Open Source (SugarCRM) before 4.2.1 Patch C (20060917) has unspecified impact, related to code execution, and unspecif… |
CVE-2006-2460 | | | 2006-05-19 | Sugar Suite Open Source (SugarCRM) 4.2 and earlier, when register_globals is enabled, does not protect critical variables such as $_GLOBALS and $_SESSION from… |
CVE-2005-4087 | | | 2005-12-08 | PHP remote file include vulnerability in acceptDecline.php in Sugar Suite Open Source Customer Relationship Management (SugarCRM) 4.0 beta and earlier allows r… |
CVE-2005-4086 | | | 2005-12-08 | Directory traversal vulnerability in acceptDecline.php in Sugar Suite Open Source Customer Relationship Management (SugarCRM) 4.0 beta and earlier allows remot… |
CVE-2004-1228 | | | 2005-01-10 | The install scripts in SugarCRM Sugar Sales 2.0.1c and earlier are not removed after installation, which allows attackers to obtain the MySQL administrative pa… |
CVE-2004-1227 | | | 2005-01-10 | Directory traversal vulnerability in SugarCRM Sugar Sales 2.0.1c and earlier allows remote attackers to read arbitrary files and possibly execute arbitrary PHP… |
CVE-2004-1226 | | | 2005-01-10 | SugarCRM Sugar Sales 2.0.1c and earlier allows remote attackers to gain sensitive information via certain requests to scripts that contain invalid input, which… |
CVE-2004-1225 | | | 2005-01-10 | SQL injection vulnerability in SugarCRM Sugar Sales before 2.0.1a allows remote attackers to execute arbitrary SQL commands and gain privileges via the record… |
CVE-2005-0266 | | | 2005-01-01 | Cross-site scripting (XSS) vulnerability in index.php in SugarCRM 1.X allows remote attackers to inject arbitrary web script or HTML via the (1) return_module… |