CVE-2026-97377

SuiteCRM is an open-source, enterprise-ready Customer Relationship Management CRM software application. Prior to 7.15.2 and 8.10.2, the legacy SOAP portal method portalgetentrylist propagates caller-controlled where and orderby values into SQL query construction without sufficient neutralization....

CVE-2026-69145

SuiteCRM is an open-source, enterprise-ready Customer Relationship Management CRM software application. Prior to 7.15.2 and 8.10.2, AOR report generation reloads the value stored in aorfields.field and concatenates it into report SQL without strict field validation. An authenticated user able to...

CVE-2026-71548

SuiteCRM is an open-source, enterprise-ready Customer Relationship Management CRM software application. Prior to 7.15.2 and 8.10.2, AORReport::buildreportquerywhere incorporates a report editor's parametervalue when valuetype=Field without sufficient validation. An authenticated user who can save...

CVE-2026-69141

SuiteCRM is an open-source, enterprise-ready Customer Relationship Management CRM software application. Prior to 7.15.2 and 8.10.2, the CasesController actiongetkbarticles action interpolates $POST'search' into a CASE WHEN ... LIKE expression and the SQL WHERE clause. Although securexss normally...

CVE-2026-69140

SuiteCRM is an open-source, enterprise-ready Customer Relationship Management CRM software application. Prior to 7.15.2 and 8.10.2, GetLatestRevision.php interpolates getlatestforid directly into an SQL UPDATE statement. Although securexss normally entity-encodes quotes, an input prefixed with an...

CVE-2026-69142

SuiteCRM is an open-source, enterprise-ready Customer Relationship Management CRM software application. Prior to 7.15.2 and 8.10.2, the jjwgMaps map marker endpoint uses the authenticated caller's distance value in the mapmarkers action without strict numeric validation or parameterization. An...

CVE-2026-69134

SuiteCRM is an open-source, enterprise-ready Customer Relationship Management CRM software application. Prior to 7.15.2 and 8.10.2, the REST v4 JSON handler reads the pre-filter RAWREQUEST value and relationship write helpers interpolate supplied field values into INSERT and UPDATE statements. Th...

CVE-2026-69136

SuiteCRM is an open-source, enterprise-ready Customer Relationship Management CRM software application. Prior to 7.15.2 and 8.10.2, email template attachment handling passes the removeattachment POST parameter array through HTML-oriented securexss processing and directly interpolates its elements...

CVE-2026-69135

SuiteCRM is an open-source, enterprise-ready Customer Relationship Management CRM software application. Prior to 7.15.2 and 8.10.2, the Project module interpolates the authenticated caller's duplicateId POST parameter directly into a SQL query without sanitization, quoting, or parameterization. A...

CVE-2026-63214

SuiteCRM is an open-source, enterprise-ready Customer Relationship Management CRM software application. Prior to 7.15.2 and 8.10.2, legacy REST methods append an authenticated caller's query parameter as a SQL WHERE clause after insufficient structural validation. The affected flow begins at...

CVE-2026-63215

SuiteCRM is an open-source, enterprise-ready Customer Relationship Management CRM software application. Prior to 7.15.2 and 8.10.2, the REST API v4.1 getentrylist method is vulnerable to time-based blind SQL injection when an authenticated caller simultaneously bypasses two independent security...

CVE-2026-61653

SuiteCRM is an open-source, enterprise-ready Customer Relationship Management CRM software application. Prior to 7.15.2 and 8.10.2, modules/Campaigns/PopupCampaignRoi.php interpolates $REQUEST'id' into SQL. Although securexss normally entity-encodes quotes, an input prefixed with an XSS payload...

CVE-2026-61651

SuiteCRM is an open-source, enterprise-ready Customer Relationship Management CRM software application. Prior to 7.15.2 and 8.10.2, the getenddate action in Projects Controller concatenates an authenticated caller's taskid value into a SQL query without parameterization. A low-privileged user can...

CVE-2026-9082

🚨 CVE-2026-9082 : SQL Injection Vulnerability in Drupal Core High-Impact SQL Injection Vulnerability in Drupal Core PostgreSQL 📋 Overview CVE-2026-9082 is a SQL Injection vulnerability in Drupal Core’s database abstraction layer. It affects only sites using PostgreSQL as the database backend. The...

CVE-2026-100359

The SuiteCRM CRM application is vulnerable to blind SQL injection in the Project Template module's action_get_end_date function. The root cause is the direct interpolation of authenticated caller-controlled task_id and lag POST parameters into SQL queries without proper sanitization, parameteriza...

EUVD-2026-117721

SuiteCRM is an open-source, enterprise-ready Customer Relationship Management CRM software application. Prior to 7.15.2 and 8.10.2, the legacy SOAP portal method portalgetentrylist propagates caller-controlled where and orderby values into SQL query construction without sufficient neutralization....

CVE-2026-97377 SuiteCRM: Authenticated SQL Injection in SOAP Portal Method portal_get_entry_list

SuiteCRM is an open-source, enterprise-ready Customer Relationship Management CRM software application. Prior to 7.15.2 and 8.10.2, the legacy SOAP portal method portalgetentrylist propagates caller-controlled where and orderby values into SQL query construction without sufficient neutralization....

CVE-2026-97377

SuiteCRM versions prior to 7.15.2 and 8.10.2 are vulnerable to blind SQL injection via the legacy SOAP portal method portal_get_entry_list. The root cause is the propagation of caller-controlled where and order_by values into SQL queries without sufficient neutralization. A low-privileged portal ...

CVE-2026-100365 SuiteCRM: Time-Based Blind SQL Injection via AOR_Reports ORDER BY Clause Allows Data Exfiltration by Any Authenticated User

SuiteCRM is an open-source, enterprise-ready Customer Relationship Management CRM software application. Prior to 7.15.2 and 8.10.2, AOR report generation concatenates an attacker-controlled stored field label into an ORDER BY clause without an allowlist. The affected flow begins at AORReports and...

CVE-2026-100365

SuiteCRM versions prior to 7.15.2 and 8.10.2 are vulnerable to a time-based blind SQL injection within the AOR report generation functionality. The root cause is the concatenation of an attacker-controlled stored field label into an ORDER BY clause without utilizing an allowlist. This vulnerabili...