Vulnerabilidades do Suitecrm Suitecrm

🔔 Criar alerta RSS Verificador de versão

CVEs publicadas que afetam Suitecrm Suitecrm: 29 registro(s), com versões afetadas e correções.
cpe:2.3:a:suitecrm:suitecrm

CVE-2025-64488 Alta · 8.8 CWE-89 07/11/2025

SuiteCRM: Authenticated SQL Injection Possible in Reschedule Call Module

SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. In versions 7.14.7 and below and 8.0.0-beta.1 through 8.9.0 8.0.0-beta.1, an attacker can craft a malicious call_id that alters the logic of the SQL query or injects arbitrary SQL. An attack can lead to unauthorized data access and data ex-filtration, complete database compromise, and other various issues. This issue is fixed in versions 7.14.8 and 8.9.1.

CVE-2022-50590 Média · 5.3 CWE-843 06/11/2025

SuiteCRM < 7.12.6 Type Confusion via 'deleteAttachment' Functionality

SuiteCRM versions prior to 7.12.6 contain a type confusion vulnerability within the processing of the ‘module’ parameter within the ‘deleteAttachment’ functionality. Successful exploitation allows remote unauthenticated attackers to alter database objects including changing the email address of the administrator.

CVE-2022-50589 Crítica · 9.8 CWE-89 06/11/2025

SuiteCRM < 7.12.6 SQL Injection via 'export' Functionality

SuiteCRM versions prior to 7.12.6 contain a SQL injection vulnerability within the processing of the ‘uid’ parameter within the ‘export’ functionality. Successful exploitation allows remote unauthenticated attackers to ultimately execute arbitrary code.

CVE-2025-41384 Média · 6.1 CWE-79 27/10/2025

Reflected Cross-Site Scripting (XSS) in SuiteCRM

Cross-Site Scripting (XSS) vulnerability reflected in SuiteCRM v7.14.1. This vulnerability allows an attacker to execute JavaScript code by modifying the HTTP Referer header to include an arbitrary domain with malicious JavaScript code at the end. The server will attempt to block the arbitrary domain but will allow the JavaScript code to execute.