CVE-2026-69136

SuiteCRM is an open-source, enterprise-ready Customer Relationship Management CRM software application. Prior to 7.15.2 and 8.10.2, email template attachment handling passes the removeattachment POST parameter array through HTML-oriented securexss processing and directly interpolates its elements...

CVE-2026-63214

SuiteCRM is an open-source, enterprise-ready Customer Relationship Management CRM software application. Prior to 7.15.2 and 8.10.2, legacy REST methods append an authenticated caller's query parameter as a SQL WHERE clause after insufficient structural validation. The affected flow begins at...

CVE-2026-63215

SuiteCRM is an open-source, enterprise-ready Customer Relationship Management CRM software application. Prior to 7.15.2 and 8.10.2, the REST API v4.1 getentrylist method is vulnerable to time-based blind SQL injection when an authenticated caller simultaneously bypasses two independent security...

CVE-2026-61648

SuiteCRM is an open-source, enterprise-ready Customer Relationship Management CRM software application. Prior to 7.15.2 and 8.10.2, a user-controllable Multi report condition passes parametervalue through unencodeMultienum and concatenates the result into a SQL WHERE clause. Although securexss...

CVE-2026-61653

SuiteCRM is an open-source, enterprise-ready Customer Relationship Management CRM software application. Prior to 7.15.2 and 8.10.2, modules/Campaigns/PopupCampaignRoi.php interpolates $REQUEST'id' into SQL. Although securexss normally entity-encodes quotes, an input prefixed with an XSS payload...

CVE-2026-61651

SuiteCRM is an open-source, enterprise-ready Customer Relationship Management CRM software application. Prior to 7.15.2 and 8.10.2, the getenddate action in Projects Controller concatenates an authenticated caller's taskid value into a SQL query without parameterization. A low-privileged user can...

CVE-2026-100365

SuiteCRM is an open-source, enterprise-ready Customer Relationship Management CRM software application. Prior to 7.15.2 and 8.10.2, AOR report generation concatenates an attacker-controlled stored field label into an ORDER BY clause without an allowlist. The affected flow begins at AORReports and...

CVE-2026-100359

SuiteCRM is an open-source, enterprise-ready Customer Relationship Management CRM software application. Prior to 7.15.2 and 8.10.2, the Project Template module's actiongetenddate function interpolates authenticated caller-controlled taskid and lag POST parameters directly into SQL without...

CVE-2026-100359 SuiteCRM: Authenticated SQL Injection In action_get_end_date function

SuiteCRM is an open-source, enterprise-ready Customer Relationship Management CRM software application. Prior to 7.15.2 and 8.10.2, the Project Template module's actiongetenddate function interpolates authenticated caller-controlled taskid and lag POST parameters directly into SQL without...

CVE-2026-100359

The SuiteCRM CRM application is vulnerable to blind SQL injection in the Project Template module's action_get_end_date function. The root cause is the direct interpolation of authenticated caller-controlled task_id and lag POST parameters into SQL queries without proper sanitization, parameteriza...

CVE-2026-97377 SuiteCRM: Authenticated SQL Injection in SOAP Portal Method portal_get_entry_list

SuiteCRM is an open-source, enterprise-ready Customer Relationship Management CRM software application. Prior to 7.15.2 and 8.10.2, the legacy SOAP portal method portalgetentrylist propagates caller-controlled where and orderby values into SQL query construction without sufficient neutralization....

EUVD-2026-117721

SuiteCRM is an open-source, enterprise-ready Customer Relationship Management CRM software application. Prior to 7.15.2 and 8.10.2, the legacy SOAP portal method portalgetentrylist propagates caller-controlled where and orderby values into SQL query construction without sufficient neutralization....

CVE-2026-97377 SuiteCRM: Authenticated SQL Injection in SOAP Portal Method portal_get_entry_list

SuiteCRM is an open-source, enterprise-ready Customer Relationship Management CRM software application. Prior to 7.15.2 and 8.10.2, the legacy SOAP portal method portalgetentrylist propagates caller-controlled where and orderby values into SQL query construction without sufficient neutralization....

CVE-2026-97377

SuiteCRM versions prior to 7.15.2 and 8.10.2 are vulnerable to blind SQL injection via the legacy SOAP portal method portal_get_entry_list. The root cause is the propagation of caller-controlled where and order_by values into SQL queries without sufficient neutralization. A low-privileged portal ...

CVE-2026-100365 SuiteCRM: Time-Based Blind SQL Injection via AOR_Reports ORDER BY Clause Allows Data Exfiltration by Any Authenticated User

SuiteCRM is an open-source, enterprise-ready Customer Relationship Management CRM software application. Prior to 7.15.2 and 8.10.2, AOR report generation concatenates an attacker-controlled stored field label into an ORDER BY clause without an allowlist. The affected flow begins at AORReports and...

CVE-2026-100365 SuiteCRM: Time-Based Blind SQL Injection via AOR_Reports ORDER BY Clause Allows Data Exfiltration by Any Authenticated User

SuiteCRM is an open-source, enterprise-ready Customer Relationship Management CRM software application. Prior to 7.15.2 and 8.10.2, AOR report generation concatenates an attacker-controlled stored field label into an ORDER BY clause without an allowlist. The affected flow begins at AORReports and...

CVE-2026-100365

SuiteCRM versions prior to 7.15.2 and 8.10.2 are vulnerable to a time-based blind SQL injection within the AOR report generation functionality. The root cause is the concatenation of an attacker-controlled stored field label into an ORDER BY clause without utilizing an allowlist. This vulnerabili...

CVE-2026-71548

In versions prior to 7.15.2 and 8.10.2 , SuiteCRM is vulnerable to an authenticated SQL injection within the AOR_Report::build_report_query_where function. The root cause is insufficient validation of the parameter_value when value_type=Field is used in the report editor. A low-privileged authent...

CVE-2026-71548 SuiteCRM: Authenticated SQL Injection in AOR_Reports `parameter_value` (value_type=Field) allows any low-privileged user to read the full database

SuiteCRM is an open-source, enterprise-ready Customer Relationship Management CRM software application. Prior to 7.15.2 and 8.10.2, AORReport::buildreportquerywhere incorporates a report editor's parametervalue when valuetype=Field without sufficient validation. An authenticated user who can save...

CVE-2026-69134 SuiteCRM: SQL Injection via REST API securexss() Bypass in Relationship Management

SuiteCRM is an open-source, enterprise-ready Customer Relationship Management CRM software application. Prior to 7.15.2 and 8.10.2, the REST v4 JSON handler reads the pre-filter RAWREQUEST value and relationship write helpers interpolate supplied field values into INSERT and UPDATE statements. Th...