# cve.now: Suitecrm

The newest entries naming Suitecrm as an affected vendor (up to 200), of 68 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-100358](https://cve.now/CVE-2026-100358.md): SuiteCRM: Admin OS RCE via Dropdown Editor PHP Injection (CVSS 9.4)
- [CVE-2026-100363](https://cve.now/CVE-2026-100363.md): SuiteCRM: Privilege escalation via V8 REST modules (ACLRoles, ACLActions, Administration) (CVSS 8.8)
- [CVE-2026-100359](https://cve.now/CVE-2026-100359.md): SuiteCRM: Authenticated SQL Injection In action\_get\_end\_date function (CVSS 6.5)
- [CVE-2026-100362](https://cve.now/CVE-2026-100362.md): SuiteCRM: V8 OAuth2 Username Enumeration (CVSS 6.9)
- [CVE-2026-97377](https://cve.now/CVE-2026-97377.md): SuiteCRM: Authenticated SQL Injection in SOAP Portal Method portal\_get\_entry\_list (CVSS 8.8)
- [CVE-2026-100360](https://cve.now/CVE-2026-100360.md): SuiteCRM: V8 API Relationship Delete Bypasses Object-Level Authorization on the Related Record (CVSS 7.1)
- [CVE-2026-100361](https://cve.now/CVE-2026-100361.md): SuiteCRM: Mass Assignment in V8 API Allows Modification of Sensitive User Fields (user\_hash, external\_auth\_only) (CVSS 7.1)
- [CVE-2026-100364](https://cve.now/CVE-2026-100364.md): SuiteCRM V8 JSON:API processAttributes() Missing ID Filter Allows ACL Bypass and Record Ownership Hijack (CVSS 7.1)
- [CVE-2026-100365](https://cve.now/CVE-2026-100365.md): SuiteCRM: Time-Based Blind SQL Injection via AOR\_Reports ORDER BY Clause Allows Data Exfiltration by Any Authenticated User (CVSS 8.8)
- [CVE-2026-71548](https://cve.now/CVE-2026-71548.md): SuiteCRM: Authenticated SQL Injection in AOR\_Reports \`parameter\_value\` (value\_type=Field) allows any low-privileged user to read the full… (CVSS 8.8)
- [CVE-2026-71550](https://cve.now/CVE-2026-71550.md): SuiteCRM: LFI to RCE via AOW\_WorkFlow (CVSS 9.9)
- [CVE-2026-69134](https://cve.now/CVE-2026-69134.md): SuiteCRM: SQL Injection via REST API securexss() Bypass in Relationship Management (CVSS 8.8)
- [CVE-2026-69141](https://cve.now/CVE-2026-69141.md): SuiteCRM: SQL injection via search param in modules/Cases/controller.php (CVSS 8.3)
- [CVE-2026-69142](https://cve.now/CVE-2026-69142.md): SuiteCRM: Authenticated SQL Injection in map\_markers distance Parameter (CVSS 8.8)
- [CVE-2026-69140](https://cve.now/CVE-2026-69140.md): SuiteCRM: SQL injection via get\_latest\_for\_id param in GetLatestRevision.php (CVSS 8.3)
- [CVE-2026-69145](https://cve.now/CVE-2026-69145.md): SuiteCRM: AOR Reports aor\_fields.field SQL Injection (CVSS 6.5)
- [CVE-2026-69136](https://cve.now/CVE-2026-69136.md): SuiteCRM: Authenticated SQL Injection In handleAttachments function (CVSS 7.1)
- [CVE-2026-69135](https://cve.now/CVE-2026-69135.md): SuiteCRM: Authenticated SQL Injection In Project Module (CVSS 7.1)
- [CVE-2026-69144](https://cve.now/CVE-2026-69144.md): SuiteCRM: Authorization Bypass via Document Revision ID Confusion in download.php (CVSS 6.5)
- [CVE-2026-69137](https://cve.now/CVE-2026-69137.md): SuiteCRM: Authenticated SSRF in CalendarAccount testConnection Allows Internal Network Access and Response Disclosure (CVSS 7.7)
- [CVE-2026-61648](https://cve.now/CVE-2026-61648.md): SuiteCRM: SQL injection via parameter\_value\[0\] param in AOR\_Report.php (CVSS 8.3)
- [CVE-2026-61650](https://cve.now/CVE-2026-61650.md): SuiteCRM: Incorrect Access Control in V8 relationship creation via missing edit authorization (CVSS 8.1)
- [CVE-2026-61653](https://cve.now/CVE-2026-61653.md): SuiteCRM: SQL injection via id param in modules/Campaigns/PopupCampaignRoi.php (CVSS 8.3)
- [CVE-2026-63213](https://cve.now/CVE-2026-63213.md): SuiteCRM: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in SuiteCRM (CVSS 7.2)
- [CVE-2026-61649](https://cve.now/CVE-2026-61649.md): SuiteCRM: isSelfRequest() bypass via substring match allows SSRF to internal services (CVSS 7.7)
- [CVE-2026-63215](https://cve.now/CVE-2026-63215.md): SuiteCRM: Time-Based Blind SQL Injection via REST API (CVSS 8.3)
- [CVE-2026-63217](https://cve.now/CVE-2026-63217.md): SuiteCRM: IDOR in generatePdf Entry Point Allows Record Data Exfiltration (CVSS 6.5)
- [CVE-2026-63214](https://cve.now/CVE-2026-63214.md): SuiteCRM: Authenticated SQL Injection in v4\_1 get\_entry\_list rest api (CVSS 8.8)
- [CVE-2026-63218](https://cve.now/CVE-2026-63218.md): SuiteCRM: Record-level Authorization Bypass via AOR\_Reports changeReportPage (CVSS 6.5)
- [CVE-2026-61651](https://cve.now/CVE-2026-61651.md): SuiteCRM: Authenticated SQL Injection in get\_end\_date function in Project Controller (CVSS 8.3)
- [CVE-2026-63111](https://cve.now/CVE-2026-63111.md): SuiteCRM: Non-admin user creates SchedulersJob: SSRF via cron (CVSS 7.1)
- [CVE-2026-108713](https://cve.now/CVE-2026-108713.md): SuiteCRM through 7.15.2 and 8.10.2 Missing Authorization via setCampaignMarketingAndTemplate (CVSS 5.3)
- [CVE-2026-108712](https://cve.now/CVE-2026-108712.md): SuiteCRM through 7.15.2 and 8.10.2 Missing Authorization via DetailUserRole Entry Point (CVSS 5.3)
- [CVE-2019-25664](https://cve.now/CVE-2019-25664.md): SuiteCRM 7.10.7 SQL Injection via record Parameter (CVSS 7.1)
- [CVE-2019-25663](https://cve.now/CVE-2019-25663.md): SuiteCRM 7.10.7 SQL Injection via parentTab Parameter (CVSS 7.1)
- [CVE-2026-32697](https://cve.now/CVE-2026-32697.md): SuiteCRM: RecordHandler::getRecord() missing ACLAccess('view') check allows any authenticated user to read any record (IDOR) (CVSS 6.5)
- [CVE-2026-29109](https://cve.now/CVE-2026-29109.md): SuiteCRM Authenticated Remote Code Execution via Unsafe Deserialization in SavedSearch Filter Processing (CVSS 8.6)
- [CVE-2026-29108](https://cve.now/CVE-2026-29108.md): Authenticated SuiteCRM Users Can Retrieve The Password Hash of Any User (CVSS 6.5)
- [CVE-2026-33289](https://cve.now/CVE-2026-33289.md): SuiterCRM has LDAP Filter Injection in Authentication Module (CVSS 8.8)
- [CVE-2026-33288](https://cve.now/CVE-2026-33288.md): SuiteCRM has Authenticated SQL Injection in Authentication Module (CVSS 8.8)
- [CVE-2026-29189](https://cve.now/CVE-2026-29189.md): SuiteCRM has a REST API V8 IDOR: Missing ACL Checks on User Preferences and Relationship Endpoints (CVSS 8.1)
- [CVE-2026-29107](https://cve.now/CVE-2026-29107.md): SuiteCRM vulnerable to authenticated SSRF via PDF export (CVSS 5.0)
- [CVE-2026-29106](https://cve.now/CVE-2026-29106.md): SuiteCRM has blind XSS in return\_id parameter (CVSS 5.9)
- [CVE-2026-29105](https://cve.now/CVE-2026-29105.md): SuiteCRM has Unauthenticated Open Redirect in Leads WebToLead Capture (CVSS 5.4)
- [CVE-2026-29104](https://cve.now/CVE-2026-29104.md): SuiteCRM Vulnerable to Authenticated Arbitrary File Upload via Configurator addfontresult View in SuiteCRM (CVSS 2.7)
- [CVE-2026-29103](https://cve.now/CVE-2026-29103.md): SuiteCRM Vulnerable to Remote Code Execution via Module Loader Package Scanner Bypass (CVSS 9.1)
- [CVE-2026-29102](https://cve.now/CVE-2026-29102.md): SuiteCRM has Authenticated RCE in Modules (CVSS 7.2)
- [CVE-2026-29101](https://cve.now/CVE-2026-29101.md): SuiteCRM Vulnerable to Directory Traversal to DoS in Modules (CVSS 4.9)
- [CVE-2026-29100](https://cve.now/CVE-2026-29100.md): SuiteCRM has Reflected HTML Injection in Login Page via default\_user\_name Parameter (CVSS 7.1)
- [CVE-2026-29099](https://cve.now/CVE-2026-29099.md): SuiteCRM has Authenticated Blind SQL Injection in OutboundEmail Legacy Functionality. (CVSS 8.8)
- [CVE-2026-29098](https://cve.now/CVE-2026-29098.md): SuiteCRM has Relative Path Traversal via ModuleBuilder Modules ExportCustom Action (CVSS 4.9)
- [CVE-2026-29097](https://cve.now/CVE-2026-29097.md): SuiteCRM Server-Side Request Forgery and Denial of Service via RSS Feed Dashlet (CVSS 7.1)
- [CVE-2026-29096](https://cve.now/CVE-2026-29096.md): SuiteCRM vulnerable to Authenticated SQL Injection via unsanitized field\_function in Report Fields (CVSS 8.1)
- [CVE-2025-64493](https://cve.now/CVE-2025-64493.md): SuiteCRM is Vulnerable to Authenticated Blind SQL Injection via GraphQL (CVSS 6.5)
- [CVE-2025-64492](https://cve.now/CVE-2025-64492.md): SuiteCRM is Vulnerable to Authenticated Time Based Blind SQL Injection (CVSS 8.8)
- [CVE-2025-64491](https://cve.now/CVE-2025-64491.md): SuiteCRM is vulnerable to unauthenticated reflected XSS through its Login page (CVSS 6.1)
- [CVE-2025-64490](https://cve.now/CVE-2025-64490.md): SuiteCRM's Inconsistent RBAC Enforcement Enables Access Control Bypass (CVSS 8.3)
- [CVE-2025-64489](https://cve.now/CVE-2025-64489.md): SuiteCRM: Privilege Escalation via Improper Session Invalidation and Inactive User Bypass (CVSS 8.3)
- [CVE-2025-64488](https://cve.now/CVE-2025-64488.md): SuiteCRM: Authenticated SQL Injection Possible in Reschedule Call Module (CVSS 8.6)
- [CVE-2022-50590](https://cve.now/CVE-2022-50590.md): SuiteCRM \< 7.12.6 Type Confusion via 'deleteAttachment' Functionality (CVSS 8.8)
- [CVE-2022-50589](https://cve.now/CVE-2022-50589.md): SuiteCRM \< 7.12.6 SQL Injection via 'export' Functionality (CVSS 9.3)
- [CVE-2025-41384](https://cve.now/CVE-2025-41384.md): Reflected Cross-Site Scripting (XSS) in SuiteCRM (CVSS 5.1)
- [CVE-2025-54787](https://cve.now/CVE-2025-54787.md): SuiteCRM: Improper Authorization for attachment downloads (CVSS 3.7)
- [CVE-2025-54784](https://cve.now/CVE-2025-54784.md): SuiteCRM is vulnerable to Cross Site Scripting (XSS) through its email viewer (CVSS 8.6)
- [CVE-2025-54783](https://cve.now/CVE-2025-54783.md): SuiteCRM: Reflected Cross Site Scripting (XSS) through HTTP Referrer header (CVSS 5.1)
- [CVE-2025-54788](https://cve.now/CVE-2025-54788.md): SuiteCRM: Authenticated Blind SQL Injection in InboundEmail module (CVSS 8.8)
- [CVE-2025-54786](https://cve.now/CVE-2025-54786.md): SuiteCRM: Legacy iCal service allows unauthenticated access to meeting data (CVSS 5.3)
- [CVE-2025-54785](https://cve.now/CVE-2025-54785.md): SuiteCRM is Vulnerable to PHP Object Injection in Reports (CVSS 8.8)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/suitecrm
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.