CVE-2026-61648

SuiteCRM versions prior to 7.15.2 and 8.10.2 are vulnerable to an SQL injection in the AOR_Report.php component. The vulnerability occurs because a user-controllable Multi report condition passes the parameter_value parameter through unencodeMultienum(), which is then concatenated into a SQL WHER...