CVE-2020-17373

CVE-2020-17373 affects SugarCRM prior to 10.1.0 (Q3 2020). The vulnerability is an SQL Injection in the Reports Export path, tied to unsanitized input (notably via the encoded current_post parameter in index.php when module=Reports/export). This can allow remote attackers to craft SQL that leaks ...

CVE-2020-17372

SugarCRM before 10.1.0 Q3 2020 allows XSS...

CVE-2020-17372

SugarCRM prior to 10.1.0 (Q3 2020) is affected by reflected XSS vulnerabilities due to insufficient validation of client-side input. Exploitable via multiple vectors (e.g., do= metadata and current_step in Reports), allowing injected script execution in a victim’s browser. Affected versions: Suga...

SugarCRM Cross Site Scripting

SugarCRM 10.1.0 Multiple Reflected Cross-Site Scripting Vulnerabilities • Software Link: https://www.sugarcrm.com/ • Affected Versions: All versions prior to 10.1.0 Q3 2020. • Vulnerabilities Description: 1 User input passed through the “do” parameter when action is set to “metadata” is not...

SugarCRM SQL Injection

SugarCRM $user, "password" = $pass, "granttype" = "password", "clientid" = "sugar"; curlsetopt$ch, CURLOPTURL, "$urlrest/v10/oauth2/token"; curlsetopt$ch, CURLOPTPOST, true; curlsetopt$ch, CURLOPTPOSTFIELDS, jsonencode$params; curlsetopt$ch, CURLOPTHTTPHEADER, "Content-Type: application/json";...

PT-2020-14930 · Sugarcrm · Sugarcrm

Name of the Vulnerable Software and Affected Versions: SugarCRM versions prior to 10.1.0 Description: The issue allows SQL Injection. Recommendations: For versions prior to 10.1.0, update to version 10.1.0 or later to resolve the issue...

CVE-2012-0694

SugarCRM CE = 6.3.1 contains scripts that use "unserialize" with user controlled input which allows remote attackers to execute arbitrary PHP code...

Code injection

SugarCRM CE = 6.3.1 contains scripts that use "unserialize" with user controlled input which allows remote attackers to execute arbitrary PHP code...

CVE-2012-0694

CVE-2012-0694 affects SugarCRM Community Edition

CVE-2012-0694

SugarCRM CE = 6.3.1 contains scripts that use "unserialize" with user controlled input which allows remote attackers to execute arbitrary PHP code...

SugarCRM 9.0.1 PHP Object Injection

--------------------------------------------------------------- SugarCRM = 9.0.1 Multiple PHP Object Injection Vulnerabilities --------------------------------------------------------------- - Software Link: https://www.sugarcrm.com - Affected Versions: Version 9.0.1 and prior versions, 8.0.3 and...

SugarCRM 9.0.1 Path Traversal

--------------------------------------------------------- SugarCRM = 9.0.1 Multiple Path Traversal Vulnerabilities --------------------------------------------------------- - Software Link: https://www.sugarcrm.com - Affected Versions: Version 9.0.1 and prior versions, 8.0.3 and prior versions. -...

SugarCRM 9.0.1 Cross Site Scripting

------------------------------------------------------------------------- SugarCRM = 9.0.1 Multiple Reflected Cross-Site Scripting Vulnerabilities ------------------------------------------------------------------------- - Software Link: https://www.sugarcrm.com - Affected Versions: Version 9.0.1...

SugarCRM 9.0.1 SQL Injection

-------------------------------------------------------- SugarCRM = 9.0.1 Multiple SQL Injection Vulnerabilities -------------------------------------------------------- - Software Link: https://www.sugarcrm.com - Affected Versions: Version 9.0.1 and prior versions, 8.0.3 and prior versions. -...

SugarCRM 9.0.1 PHP Code Injection

------------------------------------------------------------- SugarCRM = 9.0.1 Multiple PHP Code Injection Vulnerabilities ------------------------------------------------------------- - Software Link: https://www.sugarcrm.com - Affected Versions: Version 9.0.1 and prior versions, 8.0.3 and prior...

SugarCRM 9.0.1 Phar Deserialization

--------------------------------------------------------------- SugarCRM = 9.0.1 Multiple Phar Deserialization Vulnerabilities --------------------------------------------------------------- - Software Link: https://www.sugarcrm.com - Affected Versions: Version 9.0.1 and prior versions, 8.0.3 and...

SugarCRM Quotes Module SQL Injection Vulnerability

SugarCRM is a set of open source customer relationship management software . A SQL injection vulnerability exists in the Quotes module of SugarCRM. The vulnerability stems from a lack of input validation. An attacker can exploit this vulnerability to inject custom PHP code...

SugarCRM Contacts Module SQL Injection Vulnerability

SugarCRM is a set of open source customer relationship management software . A SQL injection vulnerability exists in the Contacts module of SugarCRM. The vulnerability stems from a lack of input validation. An attacker can exploit this vulnerability to inject custom PHP code...

SugarCRM PHP code injection vulnerability (CNVD-2019-34423)

SugarCRM is a set of open source customer relationship management software . A PHP code injection vulnerability exists in the ModuleBuilder module of SugarCRM. The vulnerability stems from a lack of input validation. An attacker can exploit the vulnerability to execute arbitrary code...

SugarCRM PHP code injection vulnerability (CNVD-2019-34422)

SugarCRM is a set of open source customer relationship management software . A PHP code injection vulnerability exists in the MergeRecords module of SugarCRM. The vulnerability stems from a lack of input validation. An attacker can exploit the vulnerability to execute arbitrary code...