Suitecrm vulnerabilities
68 CVEs and advisories name Suitecrm as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-100358SuiteCRM: Admin OS RCE via Dropdown Editor PHP Injection
- CVE-2026-100363SuiteCRM: Privilege escalation via V8 REST modules (ACLRoles, ACLActions, Administration)
- CVE-2026-100359SuiteCRM: Authenticated SQL Injection In action_get_end_date function
- CVE-2026-100362SuiteCRM: V8 OAuth2 Username Enumeration
- CVE-2026-97377SuiteCRM: Authenticated SQL Injection in SOAP Portal Method portal_get_entry_list
- CVE-2026-100360SuiteCRM: V8 API Relationship Delete Bypasses Object-Level Authorization on the Related Record
- CVE-2026-100361SuiteCRM: Mass Assignment in V8 API Allows Modification of Sensitive User Fields (user_hash, external_auth_only)
- CVE-2026-100364SuiteCRM V8 JSON:API processAttributes() Missing ID Filter Allows ACL Bypass and Record Ownership Hijack
- CVE-2026-100365SuiteCRM: Time-Based Blind SQL Injection via AOR_Reports ORDER BY Clause Allows Data Exfiltration by Any Authenticated User
- CVE-2026-71548SuiteCRM: Authenticated SQL Injection in AOR_Reports `parameter_value` (value_type=Field) allows any low-privileged user to read the full…
- CVE-2026-71550SuiteCRM: LFI to RCE via AOW_WorkFlow
- CVE-2026-69134SuiteCRM: SQL Injection via REST API securexss() Bypass in Relationship Management
- CVE-2026-69141SuiteCRM: SQL injection via search param in modules/Cases/controller.php
- CVE-2026-69142SuiteCRM: Authenticated SQL Injection in map_markers distance Parameter
- CVE-2026-69140SuiteCRM: SQL injection via get_latest_for_id param in GetLatestRevision.php
- CVE-2026-69145SuiteCRM: AOR Reports aor_fields.field SQL Injection
- CVE-2026-69136SuiteCRM: Authenticated SQL Injection In handleAttachments function
- CVE-2026-69135SuiteCRM: Authenticated SQL Injection In Project Module
- CVE-2026-69144SuiteCRM: Authorization Bypass via Document Revision ID Confusion in download.php
- CVE-2026-69137SuiteCRM: Authenticated SSRF in CalendarAccount testConnection Allows Internal Network Access and Response Disclosure
- CVE-2026-61648SuiteCRM: SQL injection via parameter_value[0] param in AOR_Report.php
- CVE-2026-61650SuiteCRM: Incorrect Access Control in V8 relationship creation via missing edit authorization
- CVE-2026-61653SuiteCRM: SQL injection via id param in modules/Campaigns/PopupCampaignRoi.php
- CVE-2026-63213SuiteCRM: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in SuiteCRM
- CVE-2026-61649SuiteCRM: isSelfRequest() bypass via substring match allows SSRF to internal services
- CVE-2026-63215SuiteCRM: Time-Based Blind SQL Injection via REST API
- CVE-2026-63217SuiteCRM: IDOR in generatePdf Entry Point Allows Record Data Exfiltration
- CVE-2026-63214SuiteCRM: Authenticated SQL Injection in v4_1 get_entry_list rest api
- CVE-2026-63218SuiteCRM: Record-level Authorization Bypass via AOR_Reports changeReportPage
- CVE-2026-61651SuiteCRM: Authenticated SQL Injection in get_end_date function in Project Controller