CVE-2026-71548

In versions prior to 7.15.2 and 8.10.2 , SuiteCRM is vulnerable to an authenticated SQL injection within the AOR_Report::build_report_query_where function. The root cause is insufficient validation of the parameter_value when value_type=Field is used in the report editor. A low-privileged authent...

CVE-2026-69134

The open-source CRM application SuiteCRM is vulnerable to SQL Injection in versions prior to 7.15.2 and 8.10.2 . The flaw exists in the REST v4 JSON handler , where the RAW_REQUEST value is used by relationship write helpers (including set_relationship, SugarRelationship::addRow(), SugarRelations...

CVE-2026-69141 SuiteCRM: SQL injection via search param in modules/Cases/controller.php

SuiteCRM is an open-source, enterprise-ready Customer Relationship Management CRM software application. Prior to 7.15.2 and 8.10.2, the CasesController actiongetkbarticles action interpolates $POST'search' into a CASE WHEN ... LIKE expression and the SQL WHERE clause. Although securexss normally...

EUVD-2026-117665

SuiteCRM is an open-source, enterprise-ready Customer Relationship Management CRM software application. Prior to 7.15.2 and 8.10.2, the CasesController actiongetkbarticles action interpolates $POST'search' into a CASE WHEN ... LIKE expression and the SQL WHERE clause. Although securexss normally...

CVE-2026-69141

The SuiteCRM CRM application is vulnerable to SQL injection in the CasesController action action_get_kb_articles within modules/Cases/controller.php for versions prior to 7.15.2 and 8.10.2 . The root cause is the improper interpolation of the $_POST['search'] parameter into a CASE WHEN ... LIKE e...

CVE-2026-69142

The SuiteCRM CRM software is vulnerable to an authenticated SQL injection in the jjwg_Maps map marker endpoint. The root cause is the lack of strict numeric validation or parameterization for the distance value used in the map_markers action in versions prior to 7.15.2 and 8.10.2 . An authenticat...

CVE-2026-69140

SuiteCRM versions prior to 7.15.2 and 8.10.2 are vulnerable to SQL injection in the GetLatestRevision.php component. The flaw occurs because the get_latest_for_id parameter is interpolated directly into an SQL UPDATE statement. While securexss() typically encodes quotes, an input prefixed with an...

CVE-2026-69145

The SuiteCRM application is vulnerable to an SQL Injection in the AOR report generation component prior to versions 7.15.2 and 8.10.2 . The root cause is the application's failure to perform strict field validation when reloading and concatenating the value stored in aor_fields.field into report ...

CVE-2026-69136

SuiteCRM is vulnerable to an Authenticated SQL Injection in the handleAttachments function prior to versions 7.15.2 and 8.10.2 . The root cause is that the remove_attachment POST parameter array is processed using HTML-oriented securexss() processing and then directly interpolated into an SQL UPD...

CVE-2026-69135

The SuiteCRM CRM application is vulnerable to an authenticated SQL injection in the Project module prior to versions 7.15.2 and 8.10.2 . The root cause is the interpolation of the authenticated caller's duplicateId POST parameter directly into a SQL query without proper sanitization, quoting, or ...

EUVD-2026-117660

SuiteCRM is an open-source, enterprise-ready Customer Relationship Management CRM software application. Prior to 7.15.2 and 8.10.2, the Project module interpolates the authenticated caller's duplicateId POST parameter directly into a SQL query without sanitization, quoting, or parameterization. A...

CVE-2026-69135 SuiteCRM: Authenticated SQL Injection In Project Module

SuiteCRM is an open-source, enterprise-ready Customer Relationship Management CRM software application. Prior to 7.15.2 and 8.10.2, the Project module interpolates the authenticated caller's duplicateId POST parameter directly into a SQL query without sanitization, quoting, or parameterization. A...

CVE-2026-61648

SuiteCRM versions prior to 7.15.2 and 8.10.2 are vulnerable to an SQL injection in the AOR_Report.php component. The vulnerability occurs because a user-controllable Multi report condition passes the parameter_value parameter through unencodeMultienum(), which is then concatenated into a SQL WHER...

CVE-2026-61653

SuiteCRM versions prior to 7.15.2 and 8.10.2 are vulnerable to a SQL injection flaw in the modules/Campaigns/PopupCampaignRoi.php component. The root cause is the improper interpolation of $_REQUEST['id'] into a SQL query. While the securexss() function typically encodes quotes, a specific input ...

CVE-2026-63215

The SuiteCRM CRM software is vulnerable to a time-based blind SQL injection in the REST API v4.1 get_entry_list method prior to versions 7.15.2 and 8.10.2 . An authenticated caller can trigger this vulnerability by simultaneously bypassing two unspecified security mechanisms. Successful exploitat...

CVE-2026-63214

SuiteCRM is vulnerable to an authenticated SQL injection in legacy REST methods (prior to versions 7.15.2 and 8.10.2). The vulnerability exists because query parameters are appended as a SQL WHERE clause without sufficient structural validation. The affected flow begins at /service/v4_1/rest.php ...

CVE-2026-61651

SuiteCRM is vulnerable to an authenticated SQL injection in the get_end_date action within the Projects Controller in versions prior to 7.15.2 and 8.10.2 . The root cause is the lack of parameterization when the application concatenates an authenticated caller's task_id value into a SQL query. A ...

whitewidow

Preamble Firstly readthis if you want Whitewidow development to continue. Hello all you whitewidow fans out there I say that with good intentions I promise!. It's me Ekultek, I'm just here to give you a little inside on what's going on with the whitewidow development team and what's happening wit...

Web-Security-Learning

Web-Security-Learning Repository: https://github.com/CHYbeta/Web-Security-Learning Knowledge Planet Vulnerability Attack and Defense: https://t.zsxq.com/mm2zBeq Table of Contents: Web-Security-Learning Web Security SQL Injection MySQL MSSQL PostgreSQL MongoDB Techniques Tools XSS CSRF Other...

HBSQLI

HBSQLI: Automated Tester For Header Based Blind SQL Injection HBSQLI is an automated command-line tool for performing Header Based Blind SQL injection attacks on web applications. It automates the process of detecting Header Based Blind SQL injection vulnerabilities, making it easier for security...