11 matches found
CVE-2019-18782
SuiteCRM 7.10.x prior to 7.10.21 and 7.11.x prior to 7.11.9 does not correctly implement the .htaccess protection mechanism...
EUVD-2024-36074
Malicious code in bioql PyPI...
EUVD-2021-32614
Malicious code in bioql PyPI...
EUVD-2025-23892
Malicious code in bioql PyPI...
CVE-2025-54785 SuiteCRM is Vulnerable to PHP Object Injection in Reports
SuiteCRM is an open-source, enterprise-ready Customer Relationship Management CRM software application. In versions 7.14.6 and 8.8.0, user-supplied input is not validated/sanitized before it is passed to the unserialize function, which could lead to penetration, privilege escalation, sensitive da...
CVE-2023-47643
SuiteCRM is a Customer Relationship Management CRM software application. Prior to version 8.4.2, Graphql Introspection is enabled without authentication, exposing the scheme defining all object types, arguments, and functions. An attacker can obtain the GraphQL schema and understand the entire...
CVE-2020-8787
SuiteCRM 7.10.x versions prior to 7.10.23 and 7.11.x versions prior to 7.11.11 allow for an invalid Bean ID to be submitted...
CVE-2022-45185
In SuiteCRM version 7.12.7 , an authenticated user can exploit a vulnerability by using CRM functions to upload malicious files . Subsequently, the application can be leveraged to perform deserialization , leading to code execution . As of the available documentation, there is no specific newer v...
CVE-2024-36410 SuiteCRM authenticated SQL Injection in EmailUIAjax messages count controller
SuiteCRM is an open-source Customer Relationship Management CRM software application. In versions prior to 7.14.4 and 8.6.1, poor input validation allows for SQL Injection in EmailUIAjax messages count controller. Versions 7.14.4 and 8.6.1 contain a fix for this issue...
SuiteCRM Security Breach
SuiteCRM is a customer relationship management system from the SuiteCRM team. A security vulnerability exists in SuiteCRM that stems from allowing unauthenticated IFrames to be added to certain inputs, leading to cross-site scripting attacks...
