# cve.now: Salesagility

The newest entries naming Salesagility as an affected vendor (up to 200), of 40 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2024-50335](https://cve.now/CVE-2024-50335.md): Authenticated XSS in "Publish Key" Field Allowing Unauthorized Administrator User Creation in SuiteCRM (CVSS 4.9)
- [CVE-2024-50333](https://cve.now/CVE-2024-50333.md): RCE in ModuleBuilder in SuiteCRM (CVSS 6.6)
- [CVE-2024-50332](https://cve.now/CVE-2024-50332.md): Authenticated Blind SQL Injection in DeleteRelationShip in SuiteCRM (CVSS 8.8)
- [CVE-2024-49774](https://cve.now/CVE-2024-49774.md): ModuleScanner flaws in SuiteCRM (CVSS 7.2)
- [CVE-2024-49773](https://cve.now/CVE-2024-49773.md): Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in SuiteCRM (CVSS 5.3)
- [CVE-2024-49772](https://cve.now/CVE-2024-49772.md): Authenticated SQL injection in AM\_ProjectTemplates controller in SuiteCRM (CVSS 8.8)
- [CVE-2024-45392](https://cve.now/CVE-2024-45392.md): SuiteCRM has wrong deletion permission checks on API delete call (CVSS 7.7)
- [CVE-2024-36419](https://cve.now/CVE-2024-36419.md): SuiteCRM-Core Host Header Injection in /legacy (CVSS 4.3)
- [CVE-2024-36418](https://cve.now/CVE-2024-36418.md): SuiteCRM authenticated RCE using connectors (CVSS 8.6)
- [CVE-2024-36416](https://cve.now/CVE-2024-36416.md): SuiteCRM v4 API Excessive log data DOS (CVSS 8.6)
- [CVE-2024-36417](https://cve.now/CVE-2024-36417.md): SuiteCRM Stored XSS Vulnerability Allows Code Execution via Malicious iFrame (CVSS 5.7)
- [CVE-2024-36415](https://cve.now/CVE-2024-36415.md): SuiteCRM Improper Control of Filename for Include Statement in PHP and Unrestricted Upload of File with Dangerous content leads to authenticated remote code execution (CVSS 9.1)
- [CVE-2024-36414](https://cve.now/CVE-2024-36414.md): SuiteCRM authenticated Server-Side Request Forgery (CVSS 7.7)
- [CVE-2024-36413](https://cve.now/CVE-2024-36413.md): SuiteCRM authenticated Reflected Cross-Site Scripting (CVSS 8.9)
- [CVE-2024-36412](https://cve.now/CVE-2024-36412.md): SuiteCRM unauthenticated SQL Injection (CVSS 10.0)
- [CVE-2024-36411](https://cve.now/CVE-2024-36411.md): SuiteCRM authenticated SQL Injection in EmailUIAjax displayView controller (CVSS 9.6)
- [CVE-2024-36410](https://cve.now/CVE-2024-36410.md): SuiteCRM authenticated SQL Injection in EmailUIAjax messages count controller (CVSS 9.6)
- [CVE-2024-36409](https://cve.now/CVE-2024-36409.md): SuiteCRM authenticated SQL Injection in TreeData entrypoint (CVSS 9.6)
- [CVE-2024-36408](https://cve.now/CVE-2024-36408.md): SuiteCRM authenticated SQL Injection in Alerts (CVSS 9.6)
- [CVE-2024-36407](https://cve.now/CVE-2024-36407.md): SuiteCRM unauthenticated user password reset on php7 (CVSS 3.7)
- [CVE-2024-36406](https://cve.now/CVE-2024-36406.md): SuiteCRM vulnerable to open redirects (CVSS 5.4)
- [CVE-2023-47643](https://cve.now/CVE-2023-47643.md): SuiteCRM has Unauthenticated Graphql Introspection Enabled (CVSS 3.1)
- [CVE-2023-6131](https://cve.now/CVE-2023-6131.md): Code Injection in salesagility/suitecrm (CVSS 7.2)
- [CVE-2023-6130](https://cve.now/CVE-2023-6130.md): Path Traversal: '\\..\\filename' in salesagility/suitecrm (CVSS 7.5)
- [CVE-2023-6128](https://cve.now/CVE-2023-6128.md): Cross-site Scripting (XSS) - Reflected in salesagility/suitecrm (CVSS 6.8)
- [CVE-2023-6127](https://cve.now/CVE-2023-6127.md): Unrestricted Upload of File with Dangerous Type in salesagility/suitecrm (CVSS 5.4)
- [CVE-2023-6126](https://cve.now/CVE-2023-6126.md): Code Injection in salesagility/suitecrm (CVSS 4.3)
- [CVE-2023-6125](https://cve.now/CVE-2023-6125.md): Code Injection in salesagility/suitecrm (CVSS 5.4)
- [CVE-2023-6124](https://cve.now/CVE-2023-6124.md): Server-Side Request Forgery (SSRF) in salesagility/suitecrm (CVSS 5.0)
- [CVE-2023-5353](https://cve.now/CVE-2023-5353.md): Improper Access Control in salesagility/suitecrm (CVSS 8.1)
- [CVE-2023-5351](https://cve.now/CVE-2023-5351.md): Cross-site Scripting (XSS) - Stored in salesagility/suitecrm (CVSS 8.9)
- [CVE-2023-5350](https://cve.now/CVE-2023-5350.md): SQL Injection in salesagility/suitecrm (CVSS 6.4)
- [CVE-2023-3627](https://cve.now/CVE-2023-3627.md): Cross-Site Request Forgery (CSRF) in salesagility/suitecrm-core (CVSS 8.1)
- [CVE-2023-3293](https://cve.now/CVE-2023-3293.md): Cross-site Scripting (XSS) - Stored in salesagility/suitecrm-core (CVSS 7.6)
- [CVE-2023-1034](https://cve.now/CVE-2023-1034.md): Path Traversal: '\\..\\filename' in salesagility/suitecrm (CVSS 4.3)
- [CVE-2022-0754](https://cve.now/CVE-2022-0754.md): SQL Injection in salesagility/suitecrm (CVSS 7.1)
- [CVE-2022-0756](https://cve.now/CVE-2022-0756.md): Missing Authorization in salesagility/suitecrm (CVSS 5.4)
- [CVE-2022-0755](https://cve.now/CVE-2022-0755.md): Missing Authorization in salesagility/suitecrm (CVSS 7.1)
- [CVE-2021-25960](https://cve.now/CVE-2021-25960.md): SuiteCRM - CSV Injection in Accounts Module (CVSS 8.0)
- [CVE-2021-25961](https://cve.now/CVE-2021-25961.md): SuiteCRM - Account Takeover in Password Reset Functionality (CVSS 8.0)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/salesagility
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.