CVE-2019-17318

SugarCRM before 8.0.4 and 9.x before 9.0.2 allows SQL injection in the pmseInbox module by a Regular user...

CVE-2019-17319

SugarCRM before 8.0.4 and 9.x before 9.0.2 allows SQL injection in the Emails module by a Regular user...

CVE-2019-17318

SugarCRM before 8.0.4 and 9.x before 9.0.2 allows SQL injection in the pmseInbox module by a Regular user...

CVE-2019-17316

SugarCRM before 8.0.4 and 9.x before 9.0.2 allows PHP object injection in the Import module by a Regular user...

Code injection

SugarCRM before 8.0.4 and 9.x before 9.0.2 allows PHP object injection in the Import module by a Regular user...

Sql injection

SugarCRM before 8.0.4 and 9.x before 9.0.2 allows SQL injection in the pmseInbox module by a Regular user...

Sql injection

SugarCRM before 8.0.4 and 9.x before 9.0.2 allows SQL injection in the Emails module by a Regular user...

CVE-2019-17294

SugarCRM before 8.0.4 and 9.x before 9.0.2 allows SQL injection in the export function by a Regular user...

CVE-2019-17295

SugarCRM before 8.0.4 and 9.x before 9.0.2 allows SQL injection in the history function by a Regular user...

CVE-2019-17296

SugarCRM is vulnerable to SQL injection in the Contacts module on versions before 8.0.4 and 9.x before 9.0.2 due to input validation issues; a regular user can exploit it. The CVE notes these fixes in 8.0.4 and 9.0.2. No exploitation details are provided in the connected documents.

CVE-2019-17297

CVE-2019-17297 affects SugarCRM before 8.0.4 and 9.x before 9.0.2, where a Regular user can trigger SQL injection in the Quotes module. The root cause across connected sources is inadequate input validation leading to SQL injection, with multiple references confirming the Quotes module as the vul...

CVE-2019-17297

SugarCRM before 8.0.4 and 9.x before 9.0.2 allows SQL injection in the Quotes module by a Regular user...

CVE-2019-17305

SugarCRM before 8.0.4 and 9.x before 9.0.2 allows PHP code injection in the MergeRecords module by a Regular user...

CVE-2019-17308

SugarCRM before 8.0.4 and 9.x before 9.0.2 allows PHP code injection in the Emails module by a Regular user...

CVE-2019-17311

SugarCRM before 8.0.4 and 9.x before 9.0.2 allows directory traversal in the attachment function by a Regular user...

CVE-2019-17312

SugarCRM before 8.0.4 and 9.x before 9.0.2 allows directory traversal in the file function by a Regular user...

CVE-2019-17316

SugarCRM before 8.0.4 and 9.x before 9.0.2 allows PHP object injection in the Import module by a Regular user...

CVE-2019-17318

SugarCRM before 8.0.4 and 9.x before 9.0.2 allows SQL injection in the pmseInbox module by a Regular user...

CVE-2019-17319

SugarCRM before 8.0.4 and 9.x before 9.0.2 allows SQL injection in the Emails module by a Regular user...

PT-2019-15079 · Sugarcrm · Sugarcrm

Name of the Vulnerable Software and Affected Versions: SugarCRM versions prior to 8.0.4 SugarCRM versions 9.x prior to 9.0.2 Description: The issue allows PHP object injection in the Import module by a Regular user. Recommendations: For SugarCRM versions prior to 8.0.4, update to version 8.0.4 or...