firebase

firebase Exploiting vulnerable/misconfigured Firebase databases Disclaimer: The provided software is meant for educational purposes only. Use this at your own discretion, the creator cannot be held responsible for any damages caused. Please, use responsibly! Prerequisites Non-standard python...

CVE-2026-97377

SuiteCRM is an open-source, enterprise-ready Customer Relationship Management CRM software application. Prior to 7.15.2 and 8.10.2, the legacy SOAP portal method portalgetentrylist propagates caller-controlled where and orderby values into SQL query construction without sufficient neutralization....

CVE-2026-69145

SuiteCRM is an open-source, enterprise-ready Customer Relationship Management CRM software application. Prior to 7.15.2 and 8.10.2, AOR report generation reloads the value stored in aorfields.field and concatenates it into report SQL without strict field validation. An authenticated user able to...

CVE-2026-71548

SuiteCRM is an open-source, enterprise-ready Customer Relationship Management CRM software application. Prior to 7.15.2 and 8.10.2, AORReport::buildreportquerywhere incorporates a report editor's parametervalue when valuetype=Field without sufficient validation. An authenticated user who can save...

CVE-2026-69140

SuiteCRM is an open-source, enterprise-ready Customer Relationship Management CRM software application. Prior to 7.15.2 and 8.10.2, GetLatestRevision.php interpolates getlatestforid directly into an SQL UPDATE statement. Although securexss normally entity-encodes quotes, an input prefixed with an...

CVE-2026-69141

SuiteCRM is an open-source, enterprise-ready Customer Relationship Management CRM software application. Prior to 7.15.2 and 8.10.2, the CasesController actiongetkbarticles action interpolates $POST'search' into a CASE WHEN ... LIKE expression and the SQL WHERE clause. Although securexss normally...

CVE-2026-69134

SuiteCRM is an open-source, enterprise-ready Customer Relationship Management CRM software application. Prior to 7.15.2 and 8.10.2, the REST v4 JSON handler reads the pre-filter RAWREQUEST value and relationship write helpers interpolate supplied field values into INSERT and UPDATE statements. Th...

CVE-2026-69135

SuiteCRM is an open-source, enterprise-ready Customer Relationship Management CRM software application. Prior to 7.15.2 and 8.10.2, the Project module interpolates the authenticated caller's duplicateId POST parameter directly into a SQL query without sanitization, quoting, or parameterization. A...

CVE-2026-69136

SuiteCRM is an open-source, enterprise-ready Customer Relationship Management CRM software application. Prior to 7.15.2 and 8.10.2, email template attachment handling passes the removeattachment POST parameter array through HTML-oriented securexss processing and directly interpolates its elements...

CVE-2026-63215

SuiteCRM is an open-source, enterprise-ready Customer Relationship Management CRM software application. Prior to 7.15.2 and 8.10.2, the REST API v4.1 getentrylist method is vulnerable to time-based blind SQL injection when an authenticated caller simultaneously bypasses two independent security...

CVE-2026-61651

SuiteCRM is an open-source, enterprise-ready Customer Relationship Management CRM software application. Prior to 7.15.2 and 8.10.2, the getenddate action in Projects Controller concatenates an authenticated caller's taskid value into a SQL query without parameterization. A low-privileged user can...

CVE-2026-100365

SuiteCRM is an open-source, enterprise-ready Customer Relationship Management CRM software application. Prior to 7.15.2 and 8.10.2, AOR report generation concatenates an attacker-controlled stored field label into an ORDER BY clause without an allowlist. The affected flow begins at AORReports and...

EUVD-2026-117721

SuiteCRM is an open-source, enterprise-ready Customer Relationship Management CRM software application. Prior to 7.15.2 and 8.10.2, the legacy SOAP portal method portalgetentrylist propagates caller-controlled where and orderby values into SQL query construction without sufficient neutralization....

CVE-2026-97377 SuiteCRM: Authenticated SQL Injection in SOAP Portal Method portal_get_entry_list

SuiteCRM is an open-source, enterprise-ready Customer Relationship Management CRM software application. Prior to 7.15.2 and 8.10.2, the legacy SOAP portal method portalgetentrylist propagates caller-controlled where and orderby values into SQL query construction without sufficient neutralization....

CVE-2026-97377

SuiteCRM versions prior to 7.15.2 and 8.10.2 are vulnerable to blind SQL injection via the legacy SOAP portal method portal_get_entry_list. The root cause is the propagation of caller-controlled where and order_by values into SQL queries without sufficient neutralization. A low-privileged portal ...

CVE-2026-97377 SuiteCRM: Authenticated SQL Injection in SOAP Portal Method portal_get_entry_list

SuiteCRM is an open-source, enterprise-ready Customer Relationship Management CRM software application. Prior to 7.15.2 and 8.10.2, the legacy SOAP portal method portalgetentrylist propagates caller-controlled where and orderby values into SQL query construction without sufficient neutralization....

CVE-2026-71548

In versions prior to 7.15.2 and 8.10.2 , SuiteCRM is vulnerable to an authenticated SQL injection within the AOR_Report::build_report_query_where function. The root cause is insufficient validation of the parameter_value when value_type=Field is used in the report editor. A low-privileged authent...

CVE-2026-71548 SuiteCRM: Authenticated SQL Injection in AOR_Reports `parameter_value` (value_type=Field) allows any low-privileged user to read the full database

SuiteCRM is an open-source, enterprise-ready Customer Relationship Management CRM software application. Prior to 7.15.2 and 8.10.2, AORReport::buildreportquerywhere incorporates a report editor's parametervalue when valuetype=Field without sufficient validation. An authenticated user who can save...

CVE-2026-69134 SuiteCRM: SQL Injection via REST API securexss() Bypass in Relationship Management

SuiteCRM is an open-source, enterprise-ready Customer Relationship Management CRM software application. Prior to 7.15.2 and 8.10.2, the REST v4 JSON handler reads the pre-filter RAWREQUEST value and relationship write helpers interpolate supplied field values into INSERT and UPDATE statements. Th...

CVE-2026-69141 SuiteCRM: SQL injection via search param in modules/Cases/controller.php

SuiteCRM is an open-source, enterprise-ready Customer Relationship Management CRM software application. Prior to 7.15.2 and 8.10.2, the CasesController actiongetkbarticles action interpolates $POST'search' into a CASE WHEN ... LIKE expression and the SQL WHERE clause. Although securexss normally...