- Products & ServicesProducts & Services
- SolutionsSolutions
- PricingPricing
- CompanyCompany
- ResourcesResources
en
en
| Vulnerability | Exploitation status | Fix | Affected product | Published | Severity |
|---|---|---|---|---|---|
CVE-2019-25664SuiteCRM 7.10.7 SQL Injection via record Parameter | Exploitation statusPublic exploit | FixNot confirmed | Affected productSuiteCRM | Published04/05/2026 | SeverityHigh |
CVE-2019-25663SuiteCRM 7.10.7 SQL Injection via parentTab Parameter | Exploitation statusPublic exploit | FixNot confirmed | Affected productSuiteCRM | Published04/05/2026 | SeverityHigh |
CVE-2025-64493SuiteCRM is Vulnerable to Authenticated Blind SQL Injection via GraphQL | Exploitation statusPublic exploit | FixYes | Affected productSuiteCRM-Core | Published11/08/2025 | SeverityMedium |
CVE-2025-64492SuiteCRM is Vulnerable to Authenticated Time Based Blind SQL Injection | Exploitation statusNot known exploited | FixYes | Affected productSuiteCRM-Core | Published11/08/2025 | SeverityHigh |
CVE-2025-64491SuiteCRM is vulnerable to unauthenticated reflected XSS through its Login page | Exploitation statusPublic exploit | FixYes | Affected productSuiteCRM | Published11/08/2025 | SeverityMedium |
CVE-2025-64490SuiteCRM's Inconsistent RBAC Enforcement Enables Access Control Bypass | Exploitation statusNot known exploited | FixYes | Affected productSuiteCRM | Published11/08/2025 | SeverityHigh |
CVE-2025-64489SuiteCRM: Privilege Escalation via Improper Session Invalidation and Inactive User Bypass | Exploitation statusNot known exploited | FixYes | Affected productSuiteCRM | Published11/08/2025 | SeverityHigh |
CVE-2025-64488SuiteCRM: Authenticated SQL Injection Possible in Reschedule Call Module | Exploitation statusNot known exploited | FixYes | Affected productSuiteCRM | Published11/07/2025 | SeverityHigh |
CVE-2022-50590SuiteCRM < 7.12.6 Type Confusion via 'deleteAttachment' Functionality | Exploitation statusNot known exploited | FixYes | Affected productSuiteCRM | Published11/06/2025 | SeverityHigh |
CVE-2022-50589SuiteCRM < 7.12.6 SQL Injection via 'export' Functionality | Exploitation statusNot known exploited | FixYes | Affected productSuiteCRM | Published11/06/2025 | SeverityCritical |
CVE-2025-41384Reflected Cross-Site Scripting (XSS) in SuiteCRM | Exploitation statusNot known exploited | FixYes | Affected productSuiteCRM | Published10/27/2025 | SeverityMedium |
CVE-2025-54787SuiteCRM: Improper Authorization for attachment downloads | Exploitation statusNot known exploited | FixYes | Affected productSuiteCRM | Published08/07/2025 | SeverityLow |
CVE-2025-54784SuiteCRM is vulnerable to Cross Site Scripting (XSS) through its email viewer | Exploitation statusNot known exploited | FixYes | Affected productSuiteCRM | Published08/07/2025 | SeverityHigh |
CVE-2025-54783SuiteCRM: Reflected Cross Site Scripting (XSS) through HTTP Referrer header | Exploitation statusNot known exploited | FixYes | Affected productSuiteCRM | Published08/07/2025 | SeverityMedium |
CVE-2025-54788SuiteCRM: Authenticated Blind SQL Injection in InboundEmail module | Exploitation statusNot known exploited | FixYes | Affected productSuiteCRM | Published08/06/2025 | SeverityHigh |
CVE-2025-54786SuiteCRM: Legacy iCal service allows unauthenticated access to meeting data | Exploitation statusNot known exploited | FixYes | Affected productSuiteCRM-Core | Published08/06/2025 | SeverityMedium |
CVE-2025-54785SuiteCRM is Vulnerable to PHP Object Injection in Reports | Exploitation statusNot known exploited | FixYes | Affected productSuiteCRM | Published08/06/2025 | SeverityHigh |
CVE-2022-45186 | Exploitation statusPublic exploit | FixNot confirmed | Affected productNot confirmed | Published01/07/2025 | SeverityHigh |
CVE-2022-45185 | Exploitation statusPublic exploit | FixNot confirmed | Affected productNot confirmed | Published01/07/2025 | SeverityHigh |
CVE-2024-50335Authenticated XSS in "Publish Key" Field Allowing Unauthorized Administrator User Creation in SuiteCRM | Exploitation statusNot known exploited | FixNot confirmed | Affected productSuiteCRM | Published11/05/2024 | SeverityMedium |
CVE-2024-50333RCE in ModuleBuilder in SuiteCRM | Exploitation statusNot known exploited | FixNot confirmed | Affected productSuiteCRM | Published11/05/2024 | SeverityMedium |
CVE-2024-50332Authenticated Blind SQL Injection in DeleteRelationShip in SuiteCRM | Exploitation statusNot known exploited | FixNot confirmed | Affected productSuiteCRM | Published11/05/2024 | SeverityHigh |
CVE-2024-49774ModuleScanner flaws in SuiteCRM | Exploitation statusNot known exploited | FixNot confirmed | Affected productSuiteCRM | Published11/05/2024 | SeverityHigh |
CVE-2024-49773Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in SuiteCRM | Exploitation statusNot known exploited | FixNot confirmed | Affected productSuiteCRM | Published11/05/2024 | SeverityMedium |
CVE-2024-49772Authenticated SQL injection in AM_ProjectTemplates controller in SuiteCRM | Exploitation statusNot known exploited | FixNot confirmed | Affected productSuiteCRM | Published11/05/2024 | SeverityHigh |
CVE-2024-45392SuiteCRM has wrong deletion permission checks on API delete call | Exploitation statusNot known exploited | FixNot confirmed | Affected productSuiteCRM | Published09/05/2024 | SeverityHigh |
CVE-2024-36419SuiteCRM-Core Host Header Injection in /legacy | Exploitation statusNot known exploited | FixNot confirmed | Affected productSuiteCRM-Core | Published06/10/2024 | SeverityMedium |
CVE-2024-36418SuiteCRM authenticated RCE using connectors | Exploitation statusNot known exploited | FixNot confirmed | Affected productSuiteCRM | Published06/10/2024 | SeverityHigh |
CVE-2024-36416SuiteCRM v4 API Excessive log data DOS | Exploitation statusNot known exploited | FixNot confirmed | Affected productSuiteCRM | Published06/10/2024 | SeverityHigh |
CVE-2024-36417SuiteCRM Stored XSS Vulnerability Allows Code Execution via Malicious iFrame | Exploitation statusNot known exploited | FixNot confirmed | Affected productSuiteCRM | Published06/10/2024 | SeverityMedium |
CVE-2024-36415SuiteCRM Improper Control of Filename for Include Statement in PHP and Unrestricted Upload of File with Dangerous content leads to authenticated remote code execution | Exploitation statusNot known exploited | FixNot confirmed | Affected productSuiteCRM | Published06/10/2024 | SeverityCritical |
CVE-2024-36414SuiteCRM authenticated Server-Side Request Forgery | Exploitation statusNot known exploited | FixNot confirmed | Affected productSuiteCRM | Published06/10/2024 | SeverityHigh |
CVE-2024-36413SuiteCRM authenticated Reflected Cross-Site Scripting | Exploitation statusNot known exploited | FixNot confirmed | Affected productSuiteCRM | Published06/10/2024 | SeverityHigh |
CVE-2024-36412SuiteCRM unauthenticated SQL Injection | Exploitation statusNot known exploited | FixNot confirmed | Affected productSuiteCRM | Published06/10/2024 | SeverityCritical |
CVE-2024-36411SuiteCRM authenticated SQL Injection in EmailUIAjax displayView controller | Exploitation statusNot known exploited | FixNot confirmed | Affected productSuiteCRM | Published06/10/2024 | SeverityCritical |
CVE-2024-36410SuiteCRM authenticated SQL Injection in EmailUIAjax messages count controller | Exploitation statusNot known exploited | FixNot confirmed | Affected productSuiteCRM | Published06/10/2024 | SeverityCritical |
CVE-2024-36409SuiteCRM authenticated SQL Injection in TreeData entrypoint | Exploitation statusNot known exploited | FixNot confirmed | Affected productSuiteCRM | Published06/10/2024 | SeverityCritical |
CVE-2024-36408SuiteCRM authenticated SQL Injection in Alerts | Exploitation statusNot known exploited | FixNot confirmed | Affected productSuiteCRM | Published06/10/2024 | SeverityCritical |
CVE-2024-36407SuiteCRM unauthenticated user password reset on php7 | Exploitation statusNot known exploited | FixNot confirmed | Affected productSuiteCRM | Published06/10/2024 | SeverityLow |
CVE-2024-36406SuiteCRM vulnerable to open redirects | Exploitation statusNot known exploited | FixNot confirmed | Affected productSuiteCRM | Published06/10/2024 | SeverityMedium |
CVE-2024-1644Suite CRM v7.14.2 - RCE via Local File Inclusion | Exploitation statusNot known exploited | FixNot confirmed | Affected productSuite CRM | Published02/19/2024 | SeverityCritical |
CVE-2023-6388Suite CRM v7.14.2 - SSRF | Exploitation statusNot known exploited | FixYes | Affected productSuite CRM | Published02/07/2024 | SeverityMedium |
CVE-2023-47643SuiteCRM has Unauthenticated Graphql Introspection Enabled | Exploitation statusPublic exploit | FixYes | Affected productSuiteCRM-Core | Published11/21/2023 | SeverityLow |
CVE-2023-6131Code Injection in salesagility/suitecrm | Exploitation statusPublic exploit | FixYes | Affected productsalesagility/suitecrm | Published11/14/2023 | SeverityHigh |
CVE-2023-6130Path Traversal: '\..\filename' in salesagility/suitecrm | Exploitation statusNot known exploited | FixYes | Affected productsalesagility/suitecrm | Published11/14/2023 | SeverityHigh |
CVE-2023-6128Cross-site Scripting (XSS) - Reflected in salesagility/suitecrm | Exploitation statusNot known exploited | FixYes | Affected productsalesagility/suitecrm | Published11/14/2023 | SeverityMedium |
CVE-2023-6127Unrestricted Upload of File with Dangerous Type in salesagility/suitecrm | Exploitation statusNot known exploited | FixYes | Affected productsalesagility/suitecrm | Published11/14/2023 | SeverityMedium |
CVE-2023-6126Code Injection in salesagility/suitecrm | Exploitation statusNot known exploited | FixYes | Affected productsalesagility/suitecrm | Published11/14/2023 | SeverityMedium |
CVE-2023-6125Code Injection in salesagility/suitecrm | Exploitation statusNot known exploited | FixYes | Affected productsalesagility/suitecrm | Published11/14/2023 | SeverityMedium |
CVE-2023-6124Server-Side Request Forgery (SSRF) in salesagility/suitecrm | Exploitation statusPublic exploit | FixYes | Affected productsalesagility/suitecrm | Published11/14/2023 | SeverityMedium |
CVE-2023-5353Improper Access Control in salesagility/suitecrm | Exploitation statusPublic exploit | FixYes | Affected productsalesagility/suitecrm | Published10/03/2023 | SeverityHigh |
CVE-2023-5351Cross-site Scripting (XSS) - Stored in salesagility/suitecrm | Exploitation statusPublic exploit | FixYes | Affected productsalesagility/suitecrm | Published10/03/2023 | SeverityHigh |
CVE-2023-5350SQL Injection in salesagility/suitecrm | Exploitation statusPublic exploit | FixYes | Affected productsalesagility/suitecrm | Published10/03/2023 | SeverityMedium |
CVE-2023-3627Cross-Site Request Forgery (CSRF) in salesagility/suitecrm-core | Exploitation statusPublic exploit | FixYes | Affected productsalesagility/suitecrm-core | Published07/11/2023 | SeverityHigh |
CVE-2023-3293Cross-site Scripting (XSS) - Stored in salesagility/suitecrm-core | Exploitation statusPublic exploit | FixYes | Affected productsalesagility/suitecrm-core | Published06/16/2023 | SeverityHigh |
CVE-2023-1034Path Traversal: '\..\filename' in salesagility/suitecrm | Exploitation statusPublic exploit | FixYes | Affected productsalesagility/suitecrm | Published02/25/2023 | SeverityMedium |
CVE-2022-27474 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published04/15/2022 | SeverityUnknown |
CVE-2022-23940 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published03/07/2022 | SeverityUnknown |
CVE-2022-0754SQL Injection in salesagility/suitecrm | Exploitation statusNot confirmed | FixYes | Affected productsalesagility/suitecrm | Published03/07/2022 | SeverityHigh |
CVE-2022-0756Missing Authorization in salesagility/suitecrm | Exploitation statusNot confirmed | FixYes | Affected productsalesagility/suitecrm | Published03/07/2022 | SeverityMedium |
CVE-2022-0755Missing Authorization in salesagility/suitecrm | Exploitation statusNot confirmed | FixYes | Affected productsalesagility/suitecrm | Published03/07/2022 | SeverityHigh |
CVE-2021-45899 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published01/28/2022 | SeverityUnknown |
CVE-2021-45898 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published01/28/2022 | SeverityUnknown |
CVE-2021-45897 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published01/28/2022 | SeverityUnknown |
CVE-2021-41597 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published01/12/2022 | SeverityUnknown |
CVE-2021-45903 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published12/28/2021 | SeverityUnknown |
CVE-2021-45041 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published12/19/2021 | SeverityUnknown |
CVE-2021-42840 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published10/22/2021 | SeverityUnknown |
CVE-2021-41596 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published10/04/2021 | SeverityUnknown |
CVE-2021-41595 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published10/04/2021 | SeverityUnknown |
CVE-2021-41869 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published10/04/2021 | SeverityUnknown |
CVE-2021-25960SuiteCRM - CSV Injection in Accounts Module | Exploitation statusNot confirmed | FixYes | Affected productSuiteCRM | Published09/29/2021 | SeverityHigh |
CVE-2021-25961SuiteCRM - Account Takeover in Password Reset Functionality | Exploitation statusNot confirmed | FixYes | Affected productSuiteCRM | Published09/29/2021 | SeverityHigh |
CVE-2021-39267 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published08/18/2021 | SeverityUnknown |
CVE-2021-39268 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published08/18/2021 | SeverityUnknown |
CVE-2021-31792 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published04/30/2021 | SeverityUnknown |
CVE-2020-14208 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published11/18/2020 | SeverityUnknown |
CVE-2020-15300 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published11/18/2020 | SeverityUnknown |
CVE-2020-15301 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published11/18/2020 | SeverityUnknown |
CVE-2020-28328 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published11/06/2020 | SeverityUnknown |
CVE-2019-18782 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published03/20/2020 | SeverityUnknown |
CVE-2020-8784 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published03/16/2020 | SeverityUnknown |
CVE-2020-8785 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published03/16/2020 | SeverityUnknown |
CVE-2020-8786 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published03/16/2020 | SeverityUnknown |
CVE-2020-8787 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published03/16/2020 | SeverityUnknown |
CVE-2020-8783 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published03/16/2020 | SeverityUnknown |
CVE-2020-8804 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published02/13/2020 | SeverityUnknown |
CVE-2020-8803 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published02/13/2020 | SeverityUnknown |
CVE-2020-8802 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published02/13/2020 | SeverityUnknown |
CVE-2020-8801 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published02/13/2020 | SeverityUnknown |
CVE-2020-8800 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published02/13/2020 | SeverityUnknown |
CVE-2019-18784 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published11/06/2019 | SeverityUnknown |
CVE-2019-14454 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published10/02/2019 | SeverityUnknown |
CVE-2019-13335 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published10/02/2019 | SeverityUnknown |
CVE-2019-14752 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published09/30/2019 | SeverityUnknown |
CVE-2019-16922 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published09/27/2019 | SeverityUnknown |
CVE-2019-12599 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published06/07/2019 | SeverityUnknown |
CVE-2019-12598 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published06/07/2019 | SeverityUnknown |
CVE-2019-12600 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published06/07/2019 | SeverityUnknown |
CVE-2019-12601 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published06/07/2019 | SeverityUnknown |
CyStack VulnScan continuously discovers assets, validates vulnerabilities, and helps security teams prioritize remediation across the organization.
Explore CyStack VulnScan