CVE-2019-17305

CVE-2019-17305 affects SugarCRM prior to 8.0.4 and 9.x prior to 9.0.2. The vulnerability is a PHP code injection in the MergeRecords module that can be exploited by a Regular user. The connected sources consistently describe this as a PHP code injection flaw arising from insufficient input valida...

CVE-2019-17305

SugarCRM before 8.0.4 and 9.x before 9.0.2 allows PHP code injection in the MergeRecords module by a Regular user...

CVE-2019-17306

SugarCRM versions affected:

CVE-2019-17306

SugarCRM before 8.0.4 and 9.x before 9.0.2 allows PHP code injection in the Configurator module by an Admin user...

CVE-2019-17307

Summary: CVE-2019-17307 affects SugarCRM. The vulnerability allows PHP code injection in the Tracker module when exploited by an Admin user. Affected versions are SugarCRM prior to 8.0.4 and 9.x prior to 9.0.2. The provided connected documents confirm the existence and nature of the issue but do ...

CVE-2019-17308

SugarCRM is vulnerable to PHP code injection in the Emails module (affecting versions before 8.0.4 and 9.x before 9.0.2). The issue can be triggered by a Regular user due to inadequate input validation, enabling arbitrary code execution. Affected software: SugarCRM (core product) with Email handl...

CVE-2019-17308

SugarCRM before 8.0.4 and 9.x before 9.0.2 allows PHP code injection in the Emails module by a Regular user...

CVE-2019-17309

SugarCRM before 8.0.4 and 9.x before 9.0.2 allows PHP code injection in the EmailMan module by an Admin user...

CVE-2019-17310

CVE-2019-17310 affects SugarCRM (Campaigns module) prior to 8.0.4 and 9.x prior to 9.0.2. An Admin can inject PHP code due to input handling in Campaigns, enabling arbitrary code execution. Impact described as PHP code injection with potential for full system compromise; no exploit details provid...

CVE-2019-17310

SugarCRM before 8.0.4 and 9.x before 9.0.2 allows PHP code injection in the Campaigns module by an Admin user...

CVE-2019-15748

SITOS six Build v6.2.1 permits unauthorised users to upload and import a SCORM 2004 package by browsing directly to affected pages. An unauthenticated attacker could use the upload and import functionality to import a malicious SCORM package that includes a PHP file, which could execute arbitrary...

CVE-2019-15751

CVE-2019-15751 describes an unrestricted file upload in SITOS six Build v6.2.1. The vulnerability allows an unauthenticated attacker to upload a SCORM file with an executable extension to the web root, enabling remote code execution (e.g., PHP code to run OS commands). The CVE entry is supported ...

CVE-2019-15748

SITOS six Build v6.2.1 permits unauthorised users to upload and import a SCORM 2004 package by browsing directly to affected pages. An unauthenticated attacker could use the upload and import functionality to import a malicious SCORM package that includes a PHP file, which could execute arbitrary...

PT-2019-15063

Name of the Vulnerable Software and Affected Versions SugarCRM versions prior to 8.0.4 SugarCRM versions 9.x prior to 9.0.2 Description The issue allows PHP code injection in the Administration module by a Developer user. Recommendations For SugarCRM versions prior to 8.0.4, update to version 8.0...

CVE-2019-17307: Improper Control of Generation of Code

SugarCRM before 8.0.4 and 9.x before 9.0.2 allows PHP code injection in the Tracker module by an Admin user...

PT-2019-15072

Name of the Vulnerable Software and Affected Versions SugarCRM versions prior to 8.0.4 SugarCRM versions 9.x prior to 9.0.2 Description The issue allows PHP code injection in the EmailMan module by an Admin user. Recommendations For SugarCRM versions prior to 8.0.4, update to version 8.0.4 or...

PT-2019-15064

Name of the Vulnerable Software and Affected Versions SugarCRM versions prior to 8.0.4 SugarCRM versions 9.x prior to 9.0.2 Description The issue allows PHP code injection in the ModuleBuilder module by an Admin user. Recommendations For SugarCRM versions prior to 8.0.4, update to version 8.0.4 o...

PT-2019-15071

Name of the Vulnerable Software and Affected Versions SugarCRM versions prior to 8.0.4 SugarCRM versions 9.x prior to 9.0.2 Description The issue allows PHP code injection in the Emails module by a regular user. Recommendations For SugarCRM versions prior to 8.0.4, update to version 8.0.4 or late...

PT-2019-15068

Name of the Vulnerable Software and Affected Versions SugarCRM versions prior to 8.0.4 SugarCRM versions 9.x prior to 9.0.2 Description The issue allows PHP code injection in the MergeRecords module by a Regular user. Recommendations For SugarCRM versions prior to 8.0.4, update to version 8.0.4 o...

PT-2019-15069

Name of the Vulnerable Software and Affected Versions SugarCRM versions prior to 8.0.4 SugarCRM versions 9.x prior to 9.0.2 Description The issue allows PHP code injection in the Configurator module by an Admin user. Recommendations For SugarCRM versions prior to 8.0.4, update to version 8.0.4 or...