4 matches found
CVE-2026-61653
SuiteCRM is an open-source, enterprise-ready Customer Relationship Management CRM software application. Prior to 7.15.2 and 8.10.2, modules/Campaigns/PopupCampaignRoi.php interpolates $REQUEST'id' into SQL. Although securexss normally entity-encodes quotes, an input prefixed with an XSS payload...
CVE-2026-61653 SuiteCRM: SQL injection via id param in modules/Campaigns/PopupCampaignRoi.php
SuiteCRM is an open-source, enterprise-ready Customer Relationship Management CRM software application. Prior to 7.15.2 and 8.10.2, modules/Campaigns/PopupCampaignRoi.php interpolates $REQUEST'id' into SQL. Although securexss normally entity-encodes quotes, an input prefixed with an XSS payload...
CVE-2026-61653 SuiteCRM: SQL injection via id param in modules/Campaigns/PopupCampaignRoi.php
SuiteCRM is an open-source, enterprise-ready Customer Relationship Management CRM software application. Prior to 7.15.2 and 8.10.2, modules/Campaigns/PopupCampaignRoi.php interpolates $REQUEST'id' into SQL. Although securexss normally entity-encodes quotes, an input prefixed with an XSS payload...
CVE-2026-61653
SuiteCRM versions prior to 7.15.2 and 8.10.2 are vulnerable to a SQL injection flaw in the modules/Campaigns/PopupCampaignRoi.php component. The root cause is the improper interpolation of $_REQUEST['id'] into a SQL query. While the securexss() function typically encodes quotes, a specific input ...