CVE-2026-61648

SuiteCRM is an open-source, enterprise-ready Customer Relationship Management CRM software application. Prior to 7.15.2 and 8.10.2, a user-controllable Multi report condition passes parametervalue through unencodeMultienum and concatenates the result into a SQL WHERE clause. Although securexss...

CVE-2026-71548

In versions prior to 7.15.2 and 8.10.2 , SuiteCRM is vulnerable to an authenticated SQL injection within the AOR_Report::build_report_query_where function. The root cause is insufficient validation of the parameter_value when value_type=Field is used in the report editor. A low-privileged authent...

CVE-2026-61648

SuiteCRM versions prior to 7.15.2 and 8.10.2 are vulnerable to an SQL injection in the AOR_Report.php component. The vulnerability occurs because a user-controllable Multi report condition passes the parameter_value parameter through unencodeMultienum(), which is then concatenated into a SQL WHER...