CVE-2026-69137

CVE-2026-69137 - SuiteCRM Authenticated SSRF Authenticated server-side request forgery proof of concept for SuiteCRM through the CalendarAccount/testConnection endpoint and the caldavbasic provider. Summary Affected SuiteCRM versions accept an authenticated user's serverurl and pass it to cURL...

SuiteCRM <= 7.15.1, <= 8.10.1 - Authenticated SSRF

SuiteCRM CalendarAccount testConnection accepts an attacker-controlled serverurl and passes it to cURL without destination validation. An authenticated user can cause a server-side request to loopback or internal network services. id: CVE-2026-69137 info: name: SuiteCRM = 7.15.1, = 8.10.1 -...

SuiteCRM - SQL Injection

SuiteCRM is an open-source Customer Relationship Management CRM software application. Prior to versions 7.14.4 and 8.6.1, a vulnerability in events response entry point allows for a SQL injection attack. Versions 7.14.4 and 8.6.1 contain a fix for this issue. id: CVE-2024-36412 info: name: SuiteC...

SuiteCRM Unauthenticated Graphql Introspection

Graphql Introspection is enabled without authentication, exposing the scheme defining all object types, arguments, and functions. id: CVE-2023-47643 info: name: SuiteCRM Unauthenticated Graphql Introspection author: isacaya severity: medium description: | Graphql Introspection is enabled without...

SuiteCRM-RCE

CVE-2020-28328 SuiteCRM Remote Code Execution via Log File System Setting and Log File Poisioning Overview I recently discovered two vulnerabilities in SuiteCRM that provides an attack chain for a low privileged user to achieve code execution on the underlying operating system. The attack chain i...

CVE-2022-23940

CVE-2022-23940 PoC for CVE-2022-23940 aka SCRMBT-187 - Authenticated Remote Code Execution through Scheduled Reports in SuiteCRM = 8.0.0. Defaults to False --help Show this message and exit. https://github.com/manuelz120/CVE-2022-23940 Example usage: Spawning a PHP Rev...

CVE-2021-45897

CVE-2021-45897 PoC for CVE-2021-45897 aka SCRMBT-180 - RCE via Email-Templates Authenticated only in SuiteCRM = 8.0.0. Defaults to False --help Show this message and exit. https://github.com/manuelz120/CVE-2021-45897 Example usage: .venv ➜ CVE-2021-45897 git:main ✗ ./exploit.py -u user -p --paylo...

CVE-2024-36416

CVE-2024-36416 Tool for validating CVE-2024-36416 Usage pip3 install -r requirements.txt python3 sukuna.py --help python3 sukuna.py --url http://./ --validate --payload-test Server-Side Log File Check Verify the server-side file, if the log file \service\example\proxy.log is =25MB, the server is...

CVE-2024-50335

CVE-2024-50335: Authenticated XSS in "Publish Key" Field Allowing Unauthorized Administrator User Creation Summary The "Publish Key" field in SuiteCRM's Edit Profile page is vulnerable to Reflected Cross-Site Scripting XSS, allowing an attacker to inject malicious JavaScript code. This can be...

CVE-2021-45041

CVE-2021-45041 PoC for CVE-2021-45041 aka SCRMBT-177 - Authenticated SQL-Injection in SuiteCRM = 8.0.0. Defaults to False --help Show this message and exit. https://github.com/manuelz120/CVE-2021-45041 Example usage: .venv ➜ CVE-2021-45041 git:main ✗ ./exploit.py --host http://localhost --usernam...

CVE-2026-100365

A flaw was found in SuiteCRM. An authenticated remote user with report generation access can supply crafted field labels that are concatenated directly into database queries without proper validation. This vulnerability enables SQL injection SQLi, allowing an attacker to achieve unauthorized...

CVE-2026-97377

SuiteCRM is an open-source, enterprise-ready Customer Relationship Management CRM software application. Prior to 7.15.2 and 8.10.2, the legacy SOAP portal method portalgetentrylist propagates caller-controlled where and orderby values into SQL query construction without sufficient neutralization....

CVE-2026-69145

SuiteCRM is an open-source, enterprise-ready Customer Relationship Management CRM software application. Prior to 7.15.2 and 8.10.2, AOR report generation reloads the value stored in aorfields.field and concatenates it into report SQL without strict field validation. An authenticated user able to...

CVE-2026-71550

SuiteCRM is an open-source, enterprise-ready Customer Relationship Management CRM software application. Prior to 7.15.2 and 8.10.2, the workflow controller uses a path-traversal-capable aowaction value in requireonce without constraining the resolved file. The affected flow begins at...

CVE-2026-71548

SuiteCRM is an open-source, enterprise-ready Customer Relationship Management CRM software application. Prior to 7.15.2 and 8.10.2, AORReport::buildreportquerywhere incorporates a report editor's parametervalue when valuetype=Field without sufficient validation. An authenticated user who can save...

CVE-2026-69137

SuiteCRM is an open-source, enterprise-ready Customer Relationship Management CRM software application. Prior to 7.15.2 and 8.10.2, the CalendarAccount testConnection action passes an authenticated caller's serverurl directly to curl without host, address, or scheme validation. The affected flow...

CVE-2026-69141

SuiteCRM is an open-source, enterprise-ready Customer Relationship Management CRM software application. Prior to 7.15.2 and 8.10.2, the CasesController actiongetkbarticles action interpolates $POST'search' into a CASE WHEN ... LIKE expression and the SQL WHERE clause. Although securexss normally...

CVE-2026-69140

SuiteCRM is an open-source, enterprise-ready Customer Relationship Management CRM software application. Prior to 7.15.2 and 8.10.2, GetLatestRevision.php interpolates getlatestforid directly into an SQL UPDATE statement. Although securexss normally entity-encodes quotes, an input prefixed with an...

CVE-2026-69144

SuiteCRM is an open-source, enterprise-ready Customer Relationship Management CRM software application. Prior to 7.15.2 and 8.10.2, download.php checks authorization against a Documents bean before resolving whether the supplied identifier is a documentrevisions.id. When a revision UUID is...

CVE-2026-69142

SuiteCRM is an open-source, enterprise-ready Customer Relationship Management CRM software application. Prior to 7.15.2 and 8.10.2, the jjwgMaps map marker endpoint uses the authenticated caller's distance value in the mapmarkers action without strict numeric validation or parameterization. An...