Code injection

SugarCRM before 8.0.4 and 9.x before 9.0.2 allows PHP code injection in the Administration module by an Admin user...

Code injection

SugarCRM before 8.0.4 and 9.x before 9.0.2 allows PHP code injection in the Campaigns module by an Admin user...

Code injection

SugarCRM before 8.0.4 and 9.x before 9.0.2 allows PHP code injection in the EmailMan module by an Admin user...

Sql injection

SugarCRM before 8.0.4 and 9.x before 9.0.2 allows SQL injection in the pmseInbox module by an Admin user...

Code injection

SugarCRM before 8.0.4 and 9.x before 9.0.2 allows PHP code injection in the Configurator module by an Admin user...

Directory traversal

SugarCRM before 8.0.4 and 9.x before 9.0.2 allows directory traversal in the Configurator module by an Admin user...

Code injection

SugarCRM before 8.0.4 and 9.x before 9.0.2 allows PHP code injection in the ModuleBuilder module by an Admin user...

Code injection

SugarCRM before 8.0.4 and 9.x before 9.0.2 allows PHP code injection in the Tracker module by an Admin user...

CVE-2019-17317

SugarCRM before 8.0.4 and 9.x before 9.0.2 allows PHP object injection in the UpgradeWizard module by an Admin user...

CVE-2019-17317

SugarCRM before 8.0.4 and 9.x before 9.0.2 allows PHP object injection in the UpgradeWizard module by an Admin user...

CVE-2019-17315

SugarCRM before 8.0.4 and 9.x before 9.0.2 allows PHP object injection in the Administration module by an Admin user...

CVE-2019-17315

SugarCRM before 8.0.4 and 9.x before 9.0.2 allows PHP object injection in the Administration module by an Admin user...

Design/Logic Flaw

SugarCRM before 8.0.4 and 9.x before 9.0.2 allows PHP object injection in the Administration module by an Admin user...

Code injection

SugarCRM before 8.0.4 and 9.x before 9.0.2 allows PHP object injection in the UpgradeWizard module by an Admin user...

CVE-2019-17292

CVE-2019-17292: SugarCRM versions pre-8.0.4 and 9.x pre-9.0.2 are vulnerable to SQL injection via the pmse_Inbox module, exploitable by an Admin user. This is supported by multiple connected records (NVD, RH, CNVD, CVE lists). The vulnerability is due to improper input handling in that module and...

CVE-2019-17292

SugarCRM before 8.0.4 and 9.x before 9.0.2 allows SQL injection in the pmseInbox module by an Admin user...

CVE-2019-17299

SugarCRM before 8.0.4 and 9.x before 9.0.2 allows PHP code injection in the Administration module by an Admin user...

CVE-2019-17299

CVE-2019-17299 affects SugarCRM before 8.0.4 and 9.x before 9.0.2. The vulnerability is a PHP code injection in the Administration module that can be exploited by an Admin user. Several connected sources corroborate that the issue stems from insufficient input validation, enabling code injection ...

CVE-2019-17301

SugarCRM before 8.0.4 and 9.x before 9.0.2 allows PHP code injection in the ModuleBuilder module by an Admin user...

CVE-2019-17301

CVE-2019-17301 affects SugarCRM before 8.0.4 and 9.x before 9.0.2, allowing a PHP code injection in the ModuleBuilder module by an Admin user. The issue originates from inadequate input handling in ModuleBuilder, as described in multiple sources. CVSS indicates moderate to high impact: CVSS v3.1 ...