SuiteCRM
salesagility
- Product type
- Other
- Catalog vulnerabilities
- 105
Severity across 22 analyzed records
- Products & ServicesProducts & Services
- SolutionsSolutions
- PricingPricing
- CompanyCompany
- ResourcesResources
en
en
Severity across 22 analyzed records
Verify to analyze this security profile
As of 09/14/2026, within CyStack's analyzed data, SuiteCRM has 0 security vulnerabilities published in the last 90 days. Of these, 0 are rated High or Critical. None of these vulnerabilities is listed in the CISA KEV catalog. CyStack recommends that organizations and individual users remediate applicable vulnerabilities as soon as possible.
CyStack does not yet have sufficient official-source data to identify the latest version of SuiteCRM and determine which vulnerabilities affect that version.
| Vulnerability | Exploitation status | Fix | Published | Severity |
|---|---|---|---|---|
CVE-2019-25664SuiteCRM 7.10.7 SQL Injection via record Parameter | Exploitation statusPublic exploit | FixNot confirmed | Published04/05/2026 | SeverityHigh |
CVE-2019-25663SuiteCRM 7.10.7 SQL Injection via parentTab Parameter | Exploitation statusPublic exploit | FixNot confirmed | Published04/05/2026 | SeverityHigh |
CVE-2025-64493SuiteCRM is Vulnerable to Authenticated Blind SQL Injection via GraphQL | Exploitation statusPublic exploit | FixYes | Published11/08/2025 | SeverityMedium |
CVE-2025-64492SuiteCRM is Vulnerable to Authenticated Time Based Blind SQL Injection | Exploitation statusNot known exploited | FixYes | Published11/08/2025 | SeverityHigh |
CVE-2025-64491SuiteCRM is vulnerable to unauthenticated reflected XSS through its Login page | Exploitation statusPublic exploit | FixYes | Published11/08/2025 | SeverityMedium |
CVE-2025-64490SuiteCRM's Inconsistent RBAC Enforcement Enables Access Control Bypass | Exploitation statusNot known exploited | FixYes | Published11/08/2025 | SeverityHigh |
CVE-2025-64489SuiteCRM: Privilege Escalation via Improper Session Invalidation and Inactive User Bypass | Exploitation statusNot known exploited | FixYes | Published11/08/2025 | SeverityHigh |
CVE-2025-64488SuiteCRM: Authenticated SQL Injection Possible in Reschedule Call Module | Exploitation statusNot known exploited | FixYes | Published11/07/2025 | SeverityHigh |
CVE-2022-50590SuiteCRM < 7.12.6 Type Confusion via 'deleteAttachment' Functionality | Exploitation statusNot known exploited | FixYes | Published11/06/2025 | SeverityHigh |
CVE-2022-50589SuiteCRM < 7.12.6 SQL Injection via 'export' Functionality | Exploitation statusNot known exploited | FixYes | Published11/06/2025 | SeverityCritical |
CVE-2025-41384Reflected Cross-Site Scripting (XSS) in SuiteCRM | Exploitation statusNot known exploited | FixYes | Published10/27/2025 | SeverityMedium |
CVE-2025-54787SuiteCRM: Improper Authorization for attachment downloads | Exploitation statusNot known exploited | FixYes | Published08/07/2025 | SeverityLow |
CVE-2025-54784SuiteCRM is vulnerable to Cross Site Scripting (XSS) through its email viewer | Exploitation statusNot known exploited | FixYes | Published08/07/2025 | SeverityHigh |
CVE-2025-54783SuiteCRM: Reflected Cross Site Scripting (XSS) through HTTP Referrer header | Exploitation statusNot known exploited | FixYes | Published08/07/2025 | SeverityMedium |
CVE-2025-54788SuiteCRM: Authenticated Blind SQL Injection in InboundEmail module | Exploitation statusNot known exploited | FixYes | Published08/06/2025 | SeverityHigh |
CVE-2025-54786SuiteCRM: Legacy iCal service allows unauthenticated access to meeting data | Exploitation statusNot known exploited | FixYes | Published08/06/2025 | SeverityMedium |
CVE-2025-54785SuiteCRM is Vulnerable to PHP Object Injection in Reports | Exploitation statusNot known exploited | FixYes | Published08/06/2025 | SeverityHigh |
CVE-2022-45186 | Exploitation statusPublic exploit | FixNot confirmed | Published01/07/2025 | SeverityHigh |
CVE-2022-45185 | Exploitation statusPublic exploit | FixNot confirmed | Published01/07/2025 | SeverityHigh |
CVE-2024-50335Authenticated XSS in "Publish Key" Field Allowing Unauthorized Administrator User Creation in SuiteCRM | Exploitation statusNot known exploited | FixNot confirmed | Published11/05/2024 | SeverityMedium |
CVE-2024-50333RCE in ModuleBuilder in SuiteCRM | Exploitation statusNot known exploited | FixNot confirmed | Published11/05/2024 | SeverityMedium |
CVE-2024-50332Authenticated Blind SQL Injection in DeleteRelationShip in SuiteCRM | Exploitation statusNot known exploited | FixNot confirmed | Published11/05/2024 | SeverityHigh |
CVE-2024-49774ModuleScanner flaws in SuiteCRM | Exploitation statusNot known exploited | FixNot confirmed | Published11/05/2024 | SeverityHigh |
CVE-2024-49773Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in SuiteCRM | Exploitation statusNot known exploited | FixNot confirmed | Published11/05/2024 | SeverityMedium |
CVE-2024-49772Authenticated SQL injection in AM_ProjectTemplates controller in SuiteCRM | Exploitation statusNot known exploited | FixNot confirmed | Published11/05/2024 | SeverityHigh |
CVE-2024-45392SuiteCRM has wrong deletion permission checks on API delete call | Exploitation statusNot known exploited | FixNot confirmed | Published09/05/2024 | SeverityHigh |
CVE-2024-36419SuiteCRM-Core Host Header Injection in /legacy | Exploitation statusNot known exploited | FixNot confirmed | Published06/10/2024 | SeverityMedium |
CVE-2024-36418SuiteCRM authenticated RCE using connectors | Exploitation statusNot known exploited | FixNot confirmed | Published06/10/2024 | SeverityHigh |
CVE-2024-36416SuiteCRM v4 API Excessive log data DOS | Exploitation statusNot known exploited | FixNot confirmed | Published06/10/2024 | SeverityHigh |
CVE-2024-36417SuiteCRM Stored XSS Vulnerability Allows Code Execution via Malicious iFrame | Exploitation statusNot known exploited | FixNot confirmed | Published06/10/2024 | SeverityMedium |
CVE-2024-36415SuiteCRM Improper Control of Filename for Include Statement in PHP and Unrestricted Upload of File with Dangerous content leads to authenticated remote code execution | Exploitation statusNot known exploited | FixNot confirmed | Published06/10/2024 | SeverityCritical |
CVE-2024-36414SuiteCRM authenticated Server-Side Request Forgery | Exploitation statusNot known exploited | FixNot confirmed | Published06/10/2024 | SeverityHigh |
CVE-2024-36413SuiteCRM authenticated Reflected Cross-Site Scripting | Exploitation statusNot known exploited | FixNot confirmed | Published06/10/2024 | SeverityHigh |
CVE-2024-36412SuiteCRM unauthenticated SQL Injection | Exploitation statusNot known exploited | FixNot confirmed | Published06/10/2024 | SeverityCritical |
CVE-2024-36411SuiteCRM authenticated SQL Injection in EmailUIAjax displayView controller | Exploitation statusNot known exploited | FixNot confirmed | Published06/10/2024 | SeverityCritical |
CVE-2024-36410SuiteCRM authenticated SQL Injection in EmailUIAjax messages count controller | Exploitation statusNot known exploited | FixNot confirmed | Published06/10/2024 | SeverityCritical |
CVE-2024-36409SuiteCRM authenticated SQL Injection in TreeData entrypoint | Exploitation statusNot known exploited | FixNot confirmed | Published06/10/2024 | SeverityCritical |
CVE-2024-36408SuiteCRM authenticated SQL Injection in Alerts | Exploitation statusNot known exploited | FixNot confirmed | Published06/10/2024 | SeverityCritical |
CVE-2024-36407SuiteCRM unauthenticated user password reset on php7 | Exploitation statusNot known exploited | FixNot confirmed | Published06/10/2024 | SeverityLow |
CVE-2024-36406SuiteCRM vulnerable to open redirects | Exploitation statusNot known exploited | FixNot confirmed | Published06/10/2024 | SeverityMedium |
CVE-2024-1644Suite CRM v7.14.2 - RCE via Local File Inclusion | Exploitation statusNot known exploited | FixNot confirmed | Published02/19/2024 | SeverityCritical |
CVE-2023-6388Suite CRM v7.14.2 - SSRF | Exploitation statusNot known exploited | FixYes | Published02/07/2024 | SeverityMedium |
CVE-2023-47643SuiteCRM has Unauthenticated Graphql Introspection Enabled | Exploitation statusPublic exploit | FixYes | Published11/21/2023 | SeverityLow |
CVE-2023-6131Code Injection in salesagility/suitecrm | Exploitation statusPublic exploit | FixYes | Published11/14/2023 | SeverityHigh |
CVE-2023-6130Path Traversal: '\..\filename' in salesagility/suitecrm | Exploitation statusNot known exploited | FixYes | Published11/14/2023 | SeverityHigh |
CVE-2023-6128Cross-site Scripting (XSS) - Reflected in salesagility/suitecrm | Exploitation statusNot known exploited | FixYes | Published11/14/2023 | SeverityMedium |
CVE-2023-6127Unrestricted Upload of File with Dangerous Type in salesagility/suitecrm | Exploitation statusNot known exploited | FixYes | Published11/14/2023 | SeverityMedium |
CVE-2023-6126Code Injection in salesagility/suitecrm | Exploitation statusNot known exploited | FixYes | Published11/14/2023 | SeverityMedium |
CVE-2023-6125Code Injection in salesagility/suitecrm | Exploitation statusNot known exploited | FixYes | Published11/14/2023 | SeverityMedium |
CVE-2023-6124Server-Side Request Forgery (SSRF) in salesagility/suitecrm | Exploitation statusPublic exploit | FixYes | Published11/14/2023 | SeverityMedium |
CVE-2023-5353Improper Access Control in salesagility/suitecrm | Exploitation statusPublic exploit | FixYes | Published10/03/2023 | SeverityHigh |
CVE-2023-5351Cross-site Scripting (XSS) - Stored in salesagility/suitecrm | Exploitation statusPublic exploit | FixYes | Published10/03/2023 | SeverityHigh |
CVE-2023-5350SQL Injection in salesagility/suitecrm | Exploitation statusPublic exploit | FixYes | Published10/03/2023 | SeverityMedium |
CVE-2023-3627Cross-Site Request Forgery (CSRF) in salesagility/suitecrm-core | Exploitation statusPublic exploit | FixYes | Published07/11/2023 | SeverityHigh |
CVE-2023-3293Cross-site Scripting (XSS) - Stored in salesagility/suitecrm-core | Exploitation statusPublic exploit | FixYes | Published06/16/2023 | SeverityHigh |
CVE-2023-1034Path Traversal: '\..\filename' in salesagility/suitecrm | Exploitation statusPublic exploit | FixYes | Published02/25/2023 | SeverityMedium |
CVE-2022-27474 | Exploitation statusNot confirmed | FixNot confirmed | Published04/15/2022 | SeverityUnknown |
CVE-2022-23940 | Exploitation statusNot confirmed | FixNot confirmed | Published03/07/2022 | SeverityUnknown |
CVE-2022-0754SQL Injection in salesagility/suitecrm | Exploitation statusNot confirmed | FixYes | Published03/07/2022 | SeverityHigh |
CVE-2022-0756Missing Authorization in salesagility/suitecrm | Exploitation statusNot confirmed | FixYes | Published03/07/2022 | SeverityMedium |
CVE-2022-0755Missing Authorization in salesagility/suitecrm | Exploitation statusNot confirmed | FixYes | Published03/07/2022 | SeverityHigh |
CVE-2021-45899 | Exploitation statusNot confirmed | FixNot confirmed | Published01/28/2022 | SeverityUnknown |
CVE-2021-45898 | Exploitation statusNot confirmed | FixNot confirmed | Published01/28/2022 | SeverityUnknown |
CVE-2021-45897 | Exploitation statusNot confirmed | FixNot confirmed | Published01/28/2022 | SeverityUnknown |
CVE-2021-41597 | Exploitation statusNot confirmed | FixNot confirmed | Published01/12/2022 | SeverityUnknown |
CVE-2021-45903 | Exploitation statusNot confirmed | FixNot confirmed | Published12/28/2021 | SeverityUnknown |
CVE-2021-45041 | Exploitation statusNot confirmed | FixNot confirmed | Published12/19/2021 | SeverityUnknown |
CVE-2021-42840 | Exploitation statusNot confirmed | FixNot confirmed | Published10/22/2021 | SeverityUnknown |
CVE-2021-41596 | Exploitation statusNot confirmed | FixNot confirmed | Published10/04/2021 | SeverityUnknown |
CVE-2021-41595 | Exploitation statusNot confirmed | FixNot confirmed | Published10/04/2021 | SeverityUnknown |
CVE-2021-41869 | Exploitation statusNot confirmed | FixNot confirmed | Published10/04/2021 | SeverityUnknown |
CVE-2021-25960SuiteCRM - CSV Injection in Accounts Module | Exploitation statusNot confirmed | FixYes | Published09/29/2021 | SeverityHigh |
CVE-2021-25961SuiteCRM - Account Takeover in Password Reset Functionality | Exploitation statusNot confirmed | FixYes | Published09/29/2021 | SeverityHigh |
CVE-2021-39267 | Exploitation statusNot confirmed | FixNot confirmed | Published08/18/2021 | SeverityUnknown |
CVE-2021-39268 | Exploitation statusNot confirmed | FixNot confirmed | Published08/18/2021 | SeverityUnknown |
CVE-2021-31792 | Exploitation statusNot confirmed | FixNot confirmed | Published04/30/2021 | SeverityUnknown |
CVE-2020-14208 | Exploitation statusNot confirmed | FixNot confirmed | Published11/18/2020 | SeverityUnknown |
CVE-2020-15300 | Exploitation statusNot confirmed | FixNot confirmed | Published11/18/2020 | SeverityUnknown |
CVE-2020-15301 | Exploitation statusNot confirmed | FixNot confirmed | Published11/18/2020 | SeverityUnknown |
CVE-2020-28328 | Exploitation statusNot confirmed | FixNot confirmed | Published11/06/2020 | SeverityUnknown |
CVE-2019-18782 | Exploitation statusNot confirmed | FixNot confirmed | Published03/20/2020 | SeverityUnknown |
CVE-2020-8784 | Exploitation statusNot confirmed | FixNot confirmed | Published03/16/2020 | SeverityUnknown |
CVE-2020-8785 | Exploitation statusNot confirmed | FixNot confirmed | Published03/16/2020 | SeverityUnknown |
CVE-2020-8786 | Exploitation statusNot confirmed | FixNot confirmed | Published03/16/2020 | SeverityUnknown |
CVE-2020-8787 | Exploitation statusNot confirmed | FixNot confirmed | Published03/16/2020 | SeverityUnknown |
CVE-2020-8783 | Exploitation statusNot confirmed | FixNot confirmed | Published03/16/2020 | SeverityUnknown |
CVE-2020-8804 | Exploitation statusNot confirmed | FixNot confirmed | Published02/13/2020 | SeverityUnknown |
CVE-2020-8803 | Exploitation statusNot confirmed | FixNot confirmed | Published02/13/2020 | SeverityUnknown |
CVE-2020-8802 | Exploitation statusNot confirmed | FixNot confirmed | Published02/13/2020 | SeverityUnknown |
CVE-2020-8801 | Exploitation statusNot confirmed | FixNot confirmed | Published02/13/2020 | SeverityUnknown |
CVE-2020-8800 | Exploitation statusNot confirmed | FixNot confirmed | Published02/13/2020 | SeverityUnknown |
CVE-2019-18784 | Exploitation statusNot confirmed | FixNot confirmed | Published11/06/2019 | SeverityUnknown |
CVE-2019-14454 | Exploitation statusNot confirmed | FixNot confirmed | Published10/02/2019 | SeverityUnknown |
CVE-2019-13335 | Exploitation statusNot confirmed | FixNot confirmed | Published10/02/2019 | SeverityUnknown |
CVE-2019-14752 | Exploitation statusNot confirmed | FixNot confirmed | Published09/30/2019 | SeverityUnknown |
CVE-2019-16922 | Exploitation statusNot confirmed | FixNot confirmed | Published09/27/2019 | SeverityUnknown |
CVE-2019-12599 | Exploitation statusNot confirmed | FixNot confirmed | Published06/07/2019 | SeverityUnknown |
CVE-2019-12598 | Exploitation statusNot confirmed | FixNot confirmed | Published06/07/2019 | SeverityUnknown |
CVE-2019-12600 | Exploitation statusNot confirmed | FixNot confirmed | Published06/07/2019 | SeverityUnknown |
CVE-2019-12601 | Exploitation statusNot confirmed | FixNot confirmed | Published06/07/2019 | SeverityUnknown |
CyStack VulnScan continuously discovers assets, validates vulnerabilities, and helps security teams prioritize remediation across the organization.
Explore CyStack VulnScan
