Suitecrm vulnerabilities
68 CVEs and advisories name Suitecrm as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-63111SuiteCRM: Non-admin user creates SchedulersJob: SSRF via cron
- CVE-2026-108713SuiteCRM through 7.15.2 and 8.10.2 Missing Authorization via setCampaignMarketingAndTemplate
- CVE-2026-108712SuiteCRM through 7.15.2 and 8.10.2 Missing Authorization via DetailUserRole Entry Point
- CVE-2019-25664SuiteCRM 7.10.7 SQL Injection via record Parameter
- CVE-2019-25663SuiteCRM 7.10.7 SQL Injection via parentTab Parameter
- CVE-2026-32697SuiteCRM: RecordHandler::getRecord() missing ACLAccess('view') check allows any authenticated user to read any record (IDOR)
- CVE-2026-29109SuiteCRM Authenticated Remote Code Execution via Unsafe Deserialization in SavedSearch Filter Processing
- CVE-2026-29108Authenticated SuiteCRM Users Can Retrieve The Password Hash of Any User
- CVE-2026-33289SuiterCRM has LDAP Filter Injection in Authentication Module
- CVE-2026-33288SuiteCRM has Authenticated SQL Injection in Authentication Module
- CVE-2026-29189SuiteCRM has a REST API V8 IDOR: Missing ACL Checks on User Preferences and Relationship Endpoints
- CVE-2026-29107SuiteCRM vulnerable to authenticated SSRF via PDF export
- CVE-2026-29106SuiteCRM has blind XSS in return_id parameter
- CVE-2026-29105SuiteCRM has Unauthenticated Open Redirect in Leads WebToLead Capture
- CVE-2026-29104SuiteCRM Vulnerable to Authenticated Arbitrary File Upload via Configurator addfontresult View in SuiteCRM
- CVE-2026-29103SuiteCRM Vulnerable to Remote Code Execution via Module Loader Package Scanner Bypass
- CVE-2026-29102SuiteCRM has Authenticated RCE in Modules
- CVE-2026-29101SuiteCRM Vulnerable to Directory Traversal to DoS in Modules
- CVE-2026-29100SuiteCRM has Reflected HTML Injection in Login Page via default_user_name Parameter
- CVE-2026-29099SuiteCRM has Authenticated Blind SQL Injection in OutboundEmail Legacy Functionality.
- CVE-2026-29098SuiteCRM has Relative Path Traversal via ModuleBuilder Modules ExportCustom Action
- CVE-2026-29097SuiteCRM Server-Side Request Forgery and Denial of Service via RSS Feed Dashlet
- CVE-2026-29096SuiteCRM vulnerable to Authenticated SQL Injection via unsanitized field_function in Report Fields
- CVE-2025-64493SuiteCRM is Vulnerable to Authenticated Blind SQL Injection via GraphQL
- CVE-2025-64492SuiteCRM is Vulnerable to Authenticated Time Based Blind SQL Injection
- CVE-2025-64491SuiteCRM is vulnerable to unauthenticated reflected XSS through its Login page
- CVE-2025-64490SuiteCRM's Inconsistent RBAC Enforcement Enables Access Control Bypass
- CVE-2025-64489SuiteCRM: Privilege Escalation via Improper Session Invalidation and Inactive User Bypass
- CVE-2025-64488SuiteCRM: Authenticated SQL Injection Possible in Reschedule Call Module
- CVE-2022-50590SuiteCRM < 7.12.6 Type Confusion via 'deleteAttachment' Functionality