Log in Start free

SuiteCRM

Products

ProductCVEsExploitedLatest
SuiteCRM60–Nov 5, 2026
SuiteCRM-Core6–Mar 19, 2026

Exploited and recent CVEs

  • CVE-2026-100358 Critical 9.4 SuiteCRM: Admin OS RCE via Dropdown Editor PHP Injection 0.4%
  • CVE-2026-100363 High 8.8 SuiteCRM: Privilege escalation via V8 REST modules (ACLRoles, ACLActions, Administration) 0.3%
  • CVE-2026-100359 Medium 6.5 SuiteCRM: Authenticated SQL Injection In action_get_end_date function 0.3%
  • CVE-2026-100362 Medium 6.9 SuiteCRM: V8 OAuth2 Username Enumeration 0.4%
  • CVE-2026-97377 High 8.8 SuiteCRM: Authenticated SQL Injection in SOAP Portal Method portal_get_entry_list 0.4%
  • CVE-2026-100360 High 7.1 SuiteCRM: V8 API Relationship Delete Bypasses Object-Level Authorization on the Related Record 0.4%
  • CVE-2026-100361 High 7.1 SuiteCRM: Mass Assignment in V8 API Allows Modification of Sensitive User Fields (user_hash, external_auth_only) 0.3%
  • CVE-2026-100364 High 7.1 SuiteCRM V8 JSON:API processAttributes() Missing ID Filter Allows ACL Bypass and Record Ownership Hijack 0.2%
  • CVE-2026-100365 High 8.8 SuiteCRM: Time-Based Blind SQL Injection via AOR_Reports ORDER BY Clause Allows Data Exfiltration by Any Authenticated User 0.4%
  • CVE-2026-71548 High 8.8 SuiteCRM: Authenticated SQL Injection in AOR_Reports `parameter_value` (value_type=Field) allows any low-privileged user to read the full database 0.3%
  • CVE-2026-71550 Critical 9.9 SuiteCRM: LFI to RCE via AOW_WorkFlow 0.4%
  • CVE-2026-69134 High 8.8 SuiteCRM: SQL Injection via REST API securexss() Bypass in Relationship Management 0.4%
  • CVE-2026-69141 High 8.3 SuiteCRM: SQL injection via search param in modules/Cases/controller.php 0.3%
  • CVE-2026-69142 High 8.8 SuiteCRM: Authenticated SQL Injection in map_markers distance Parameter 0.4%
  • CVE-2026-69140 High 8.3 SuiteCRM: SQL injection via get_latest_for_id param in GetLatestRevision.php 0.3%
  • CVE-2026-69145 Medium 6.5 SuiteCRM: AOR Reports aor_fields.field SQL Injection 0.3%
  • CVE-2026-69136 High 7.1 SuiteCRM: Authenticated SQL Injection In handleAttachments function 0.2%
  • CVE-2026-69135 High 7.1 SuiteCRM: Authenticated SQL Injection In Project Module 0.3%
  • CVE-2026-69144 Medium 6.5 SuiteCRM: Authorization Bypass via Document Revision ID Confusion in download.php 0.3%
  • CVE-2026-69137 High 7.7 SuiteCRM: Authenticated SSRF in CalendarAccount testConnection Allows Internal Network Access and Response Disclosure 3.8%
  • CVE-2026-61648 High 8.3 SuiteCRM: SQL injection via parameter_value[0] param in AOR_Report.php 0.2%
  • CVE-2026-61650 High 8.1 SuiteCRM: Incorrect Access Control in V8 relationship creation via missing edit authorization 0.2%
  • CVE-2026-61653 High 8.3 SuiteCRM: SQL injection via id param in modules/Campaigns/PopupCampaignRoi.php 0.2%
  • CVE-2026-63213 High 7.2 SuiteCRM: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in SuiteCRM 0.6%
  • CVE-2026-61649 High 7.7 SuiteCRM: isSelfRequest() bypass via substring match allows SSRF to internal services 0.3%
  • CVE-2026-63215 High 8.3 SuiteCRM: Time-Based Blind SQL Injection via REST API 0.3%
  • CVE-2026-63217 Medium 6.5 SuiteCRM: IDOR in generatePdf Entry Point Allows Record Data Exfiltration 0.3%
  • CVE-2026-63214 High 8.8 SuiteCRM: Authenticated SQL Injection in v4_1 get_entry_list rest api 0.5%
  • CVE-2026-63218 Medium 6.5 SuiteCRM: Record-level Authorization Bypass via AOR_Reports changeReportPage 0.4%
  • CVE-2026-61651 High 8.3 SuiteCRM: Authenticated SQL Injection in get_end_date function in Project Controller 0.3%