CVE-2026-69141

SuiteCRM is an open-source, enterprise-ready Customer Relationship Management CRM software application. Prior to 7.15.2 and 8.10.2, the CasesController actiongetkbarticles action interpolates $POST'search' into a CASE WHEN ... LIKE expression and the SQL WHERE clause. Although securexss normally...

CVE-2026-69142

SuiteCRM is an open-source, enterprise-ready Customer Relationship Management CRM software application. Prior to 7.15.2 and 8.10.2, the jjwgMaps map marker endpoint uses the authenticated caller's distance value in the mapmarkers action without strict numeric validation or parameterization. An...

CVE-2026-69134

SuiteCRM is an open-source, enterprise-ready Customer Relationship Management CRM software application. Prior to 7.15.2 and 8.10.2, the REST v4 JSON handler reads the pre-filter RAWREQUEST value and relationship write helpers interpolate supplied field values into INSERT and UPDATE statements. Th...

CVE-2026-69135

SuiteCRM is an open-source, enterprise-ready Customer Relationship Management CRM software application. Prior to 7.15.2 and 8.10.2, the Project module interpolates the authenticated caller's duplicateId POST parameter directly into a SQL query without sanitization, quoting, or parameterization. A...

CVE-2026-69136

SuiteCRM is an open-source, enterprise-ready Customer Relationship Management CRM software application. Prior to 7.15.2 and 8.10.2, email template attachment handling passes the removeattachment POST parameter array through HTML-oriented securexss processing and directly interpolates its elements...

CVE-2026-63214

SuiteCRM is an open-source, enterprise-ready Customer Relationship Management CRM software application. Prior to 7.15.2 and 8.10.2, legacy REST methods append an authenticated caller's query parameter as a SQL WHERE clause after insufficient structural validation. The affected flow begins at...

CVE-2026-63215

SuiteCRM is an open-source, enterprise-ready Customer Relationship Management CRM software application. Prior to 7.15.2 and 8.10.2, the REST API v4.1 getentrylist method is vulnerable to time-based blind SQL injection when an authenticated caller simultaneously bypasses two independent security...

CVE-2026-61648

SuiteCRM is an open-source, enterprise-ready Customer Relationship Management CRM software application. Prior to 7.15.2 and 8.10.2, a user-controllable Multi report condition passes parametervalue through unencodeMultienum and concatenates the result into a SQL WHERE clause. Although securexss...

CVE-2026-61653

SuiteCRM is an open-source, enterprise-ready Customer Relationship Management CRM software application. Prior to 7.15.2 and 8.10.2, modules/Campaigns/PopupCampaignRoi.php interpolates $REQUEST'id' into SQL. Although securexss normally entity-encodes quotes, an input prefixed with an XSS payload...

CVE-2026-61651

SuiteCRM is an open-source, enterprise-ready Customer Relationship Management CRM software application. Prior to 7.15.2 and 8.10.2, the getenddate action in Projects Controller concatenates an authenticated caller's taskid value into a SQL query without parameterization. A low-privileged user can...

CVE-2026-100365

SuiteCRM is an open-source, enterprise-ready Customer Relationship Management CRM software application. Prior to 7.15.2 and 8.10.2, AOR report generation concatenates an attacker-controlled stored field label into an ORDER BY clause without an allowlist. The affected flow begins at AORReports and...

CVE-2026-100359

SuiteCRM is an open-source, enterprise-ready Customer Relationship Management CRM software application. Prior to 7.15.2 and 8.10.2, the Project Template module's actiongetenddate function interpolates authenticated caller-controlled taskid and lag POST parameters directly into SQL without...

CVE-2026-9082

🚨 CVE-2026-9082 : SQL Injection Vulnerability in Drupal Core High-Impact SQL Injection Vulnerability in Drupal Core PostgreSQL 📋 Overview CVE-2026-9082 is a SQL Injection vulnerability in Drupal Core’s database abstraction layer. It affects only sites using PostgreSQL as the database backend. The...

CVE-2026-100359

The SuiteCRM CRM application is vulnerable to blind SQL injection in the Project Template module's action_get_end_date function. The root cause is the direct interpolation of authenticated caller-controlled task_id and lag POST parameters into SQL queries without proper sanitization, parameteriza...

EUVD-2026-117721

SuiteCRM is an open-source, enterprise-ready Customer Relationship Management CRM software application. Prior to 7.15.2 and 8.10.2, the legacy SOAP portal method portalgetentrylist propagates caller-controlled where and orderby values into SQL query construction without sufficient neutralization....

CVE-2026-97377

SuiteCRM versions prior to 7.15.2 and 8.10.2 are vulnerable to blind SQL injection via the legacy SOAP portal method portal_get_entry_list. The root cause is the propagation of caller-controlled where and order_by values into SQL queries without sufficient neutralization. A low-privileged portal ...

CVE-2026-97377 SuiteCRM: Authenticated SQL Injection in SOAP Portal Method portal_get_entry_list

SuiteCRM is an open-source, enterprise-ready Customer Relationship Management CRM software application. Prior to 7.15.2 and 8.10.2, the legacy SOAP portal method portalgetentrylist propagates caller-controlled where and orderby values into SQL query construction without sufficient neutralization....

CVE-2026-100365 SuiteCRM: Time-Based Blind SQL Injection via AOR_Reports ORDER BY Clause Allows Data Exfiltration by Any Authenticated User

SuiteCRM is an open-source, enterprise-ready Customer Relationship Management CRM software application. Prior to 7.15.2 and 8.10.2, AOR report generation concatenates an attacker-controlled stored field label into an ORDER BY clause without an allowlist. The affected flow begins at AORReports and...

CVE-2026-100365

SuiteCRM versions prior to 7.15.2 and 8.10.2 are vulnerable to a time-based blind SQL injection within the AOR report generation functionality. The root cause is the concatenation of an attacker-controlled stored field label into an ORDER BY clause without utilizing an allowlist. This vulnerabili...

CVE-2026-71548

In versions prior to 7.15.2 and 8.10.2 , SuiteCRM is vulnerable to an authenticated SQL injection within the AOR_Report::build_report_query_where function. The root cause is insufficient validation of the parameter_value when value_type=Field is used in the report editor. A low-privileged authent...