CVE-2026-69141 SuiteCRM: SQL injection via search param in modules/Cases/controller.php

SuiteCRM is an open-source, enterprise-ready Customer Relationship Management CRM software application. Prior to 7.15.2 and 8.10.2, the CasesController actiongetkbarticles action interpolates $POST'search' into a CASE WHEN ... LIKE expression and the SQL WHERE clause. Although securexss normally...

CVE-2026-69141

The SuiteCRM CRM application is vulnerable to SQL injection in the CasesController action action_get_kb_articles within modules/Cases/controller.php for versions prior to 7.15.2 and 8.10.2 . The root cause is the improper interpolation of the $_POST['search'] parameter into a CASE WHEN ... LIKE e...

EUVD-2026-117665

SuiteCRM is an open-source, enterprise-ready Customer Relationship Management CRM software application. Prior to 7.15.2 and 8.10.2, the CasesController actiongetkbarticles action interpolates $POST'search' into a CASE WHEN ... LIKE expression and the SQL WHERE clause. Although securexss normally...

CVE-2026-69142

The SuiteCRM CRM software is vulnerable to an authenticated SQL injection in the jjwg_Maps map marker endpoint. The root cause is the lack of strict numeric validation or parameterization for the distance value used in the map_markers action in versions prior to 7.15.2 and 8.10.2 . An authenticat...

CVE-2026-69140

SuiteCRM versions prior to 7.15.2 and 8.10.2 are vulnerable to SQL injection in the GetLatestRevision.php component. The flaw occurs because the get_latest_for_id parameter is interpolated directly into an SQL UPDATE statement. While securexss() typically encodes quotes, an input prefixed with an...

CVE-2026-69145

The SuiteCRM application is vulnerable to an SQL Injection in the AOR report generation component prior to versions 7.15.2 and 8.10.2 . The root cause is the application's failure to perform strict field validation when reloading and concatenating the value stored in aor_fields.field into report ...

CVE-2026-69136

SuiteCRM is vulnerable to an Authenticated SQL Injection in the handleAttachments function prior to versions 7.15.2 and 8.10.2 . The root cause is that the remove_attachment POST parameter array is processed using HTML-oriented securexss() processing and then directly interpolated into an SQL UPD...

CVE-2026-69135

The SuiteCRM CRM application is vulnerable to an authenticated SQL injection in the Project module prior to versions 7.15.2 and 8.10.2 . The root cause is the interpolation of the authenticated caller's duplicateId POST parameter directly into a SQL query without proper sanitization, quoting, or ...

CVE-2026-69135 SuiteCRM: Authenticated SQL Injection In Project Module

SuiteCRM is an open-source, enterprise-ready Customer Relationship Management CRM software application. Prior to 7.15.2 and 8.10.2, the Project module interpolates the authenticated caller's duplicateId POST parameter directly into a SQL query without sanitization, quoting, or parameterization. A...

EUVD-2026-117660

SuiteCRM is an open-source, enterprise-ready Customer Relationship Management CRM software application. Prior to 7.15.2 and 8.10.2, the Project module interpolates the authenticated caller's duplicateId POST parameter directly into a SQL query without sanitization, quoting, or parameterization. A...

CVE-2026-69135 SuiteCRM: Authenticated SQL Injection In Project Module

SuiteCRM is an open-source, enterprise-ready Customer Relationship Management CRM software application. Prior to 7.15.2 and 8.10.2, the Project module interpolates the authenticated caller's duplicateId POST parameter directly into a SQL query without sanitization, quoting, or parameterization. A...

CVE-2026-61648

SuiteCRM versions prior to 7.15.2 and 8.10.2 are vulnerable to an SQL injection in the AOR_Report.php component. The vulnerability occurs because a user-controllable Multi report condition passes the parameter_value parameter through unencodeMultienum(), which is then concatenated into a SQL WHER...

CVE-2026-61653

SuiteCRM versions prior to 7.15.2 and 8.10.2 are vulnerable to a SQL injection flaw in the modules/Campaigns/PopupCampaignRoi.php component. The root cause is the improper interpolation of $_REQUEST['id'] into a SQL query. While the securexss() function typically encodes quotes, a specific input ...

CVE-2026-63215

The SuiteCRM CRM software is vulnerable to a time-based blind SQL injection in the REST API v4.1 get_entry_list method prior to versions 7.15.2 and 8.10.2 . An authenticated caller can trigger this vulnerability by simultaneously bypassing two unspecified security mechanisms. Successful exploitat...

CVE-2026-63214

SuiteCRM is vulnerable to an authenticated SQL injection in legacy REST methods (prior to versions 7.15.2 and 8.10.2). The vulnerability exists because query parameters are appended as a SQL WHERE clause without sufficient structural validation. The affected flow begins at /service/v4_1/rest.php ...

CVE-2026-61651

SuiteCRM is vulnerable to an authenticated SQL injection in the get_end_date action within the Projects Controller in versions prior to 7.15.2 and 8.10.2 . The root cause is the lack of parameterization when the application concatenates an authenticated caller's task_id value into a SQL query. A ...

whitewidow

Preamble Firstly readthis if you want Whitewidow development to continue. Hello all you whitewidow fans out there I say that with good intentions I promise!. It's me Ekultek, I'm just here to give you a little inside on what's going on with the whitewidow development team and what's happening wit...

Web-Security-Learning

Web-Security-Learning Repository: https://github.com/CHYbeta/Web-Security-Learning Knowledge Planet Vulnerability Attack and Defense: https://t.zsxq.com/mm2zBeq Table of Contents: Web-Security-Learning Web Security SQL Injection MySQL MSSQL PostgreSQL MongoDB Techniques Tools XSS CSRF Other...

HBSQLI

HBSQLI: Automated Tester For Header Based Blind SQL Injection HBSQLI is an automated command-line tool for performing Header Based Blind SQL injection attacks on web applications. It automates the process of detecting Header Based Blind SQL injection vulnerabilities, making it easier for security...

sqlipy

sqlipy SQLiPy is a Python plugin for Burp Suite that integrates SQLMap using the SQLMap API. SQLMap comes with a RESTful based server that will execute SQLMap scans. This plugin can start the API for you or connect to an already running API to perform a scan. Requirements Jython 2.7 up to 2.7.2 D...