en
SuiteCRM is an open-source, enterprise-ready Customer Relationship Management application maintained by SuiteCRM Ltd. It centralizes customer information and supports sales, marketing, and service workflows. The software is commonly deployed as a self-hosted web application for organizations that need control over data, configuration, and extensions.
| Vulnerability | Exploitation status | Fix | Affected product | Published | Severity |
|---|---|---|---|---|---|
CVE-2019-25664SuiteCRM 7.10.7 SQL Injection via record Parameter | Exploitation statusPublic exploit | FixNot confirmed | Affected productSuiteCRM | Published04/05/2026 | SeverityHigh |
CVE-2019-25663SuiteCRM 7.10.7 SQL Injection via parentTab Parameter | Exploitation statusPublic exploit | FixNot confirmed | Affected productSuiteCRM | Published04/05/2026 | SeverityHigh |
CVE-2026-32697SuiteCRM: RecordHandler::getRecord() missing ACLAccess('view') check allows any authenticated user to read any record (IDOR) | Exploitation statusNot known exploited | FixNot confirmed | Affected productSuiteCRM-Core | Published03/19/2026 | SeverityMedium |
CVE-2026-29109SuiteCRM Authenticated Remote Code Execution via Unsafe Deserialization in SavedSearch Filter Processing | Exploitation statusNot known exploited | FixNot confirmed | Affected productSuiteCRM-Core | Published03/19/2026 | SeverityHigh |
CVE-2026-29108Authenticated SuiteCRM Users Can Retrieve The Password Hash of Any User | Exploitation statusNot known exploited | FixNot confirmed | Affected productSuiteCRM-Core | Published03/19/2026 | SeverityMedium |
CVE-2026-33289SuiterCRM has LDAP Filter Injection in Authentication Module | Exploitation statusNot known exploited | FixNot confirmed | Affected productSuiteCRM | Published03/19/2026 | SeverityHigh |
CVE-2026-33288SuiteCRM has Authenticated SQL Injection in Authentication Module | Exploitation statusNot known exploited | FixNot confirmed | Affected productSuiteCRM | Published03/19/2026 | SeverityHigh |
CVE-2026-29189SuiteCRM has a REST API V8 IDOR: Missing ACL Checks on User Preferences and Relationship Endpoints | Exploitation statusNot known exploited | FixNot confirmed | Affected productSuiteCRM | Published03/19/2026 | SeverityHigh |
CVE-2026-29107SuiteCRM vulnerable to authenticated SSRF via PDF export | Exploitation statusNot known exploited | FixNot confirmed | Affected productSuiteCRM | Published03/19/2026 | SeverityMedium |
CVE-2026-29106SuiteCRM has blind XSS in return_id parameter | Exploitation statusNot known exploited | FixNot confirmed | Affected productSuiteCRM | Published03/19/2026 | SeverityMedium |
CVE-2026-29105SuiteCRM has Unauthenticated Open Redirect in Leads WebToLead Capture | Exploitation statusNot known exploited | FixNot confirmed | Affected productSuiteCRM | Published03/19/2026 | SeverityMedium |
CVE-2026-29104SuiteCRM Vulnerable to Authenticated Arbitrary File Upload via Configurator addfontresult View in SuiteCRM | Exploitation statusNot known exploited | FixNot confirmed | Affected productSuiteCRM | Published03/19/2026 | SeverityLow |
CVE-2026-29103SuiteCRM Vulnerable to Remote Code Execution via Module Loader Package Scanner Bypass | Exploitation statusNot known exploited | FixNot confirmed | Affected productSuiteCRM | Published03/19/2026 | SeverityCritical |
CVE-2026-29102SuiteCRM has Authenticated RCE in Modules | Exploitation statusNot known exploited | FixNot confirmed | Affected productSuiteCRM | Published03/19/2026 | SeverityHigh |
CVE-2026-29101SuiteCRM Vulnerable to Directory Traversal to DoS in Modules | Exploitation statusNot known exploited | FixNot confirmed | Affected productSuiteCRM | Published03/19/2026 | SeverityMedium |
CVE-2026-29100SuiteCRM has Reflected HTML Injection in Login Page via default_user_name Parameter | Exploitation statusNot known exploited | FixNot confirmed | Affected productSuiteCRM | Published03/19/2026 | SeverityHigh |
CVE-2026-29099SuiteCRM has Authenticated Blind SQL Injection in OutboundEmail Legacy Functionality. | Exploitation statusNot known exploited | FixNot confirmed | Affected productSuiteCRM | Published03/19/2026 | SeverityHigh |
CVE-2026-29098SuiteCRM has Relative Path Traversal via ModuleBuilder Modules ExportCustom Action | Exploitation statusNot known exploited | FixNot confirmed | Affected productSuiteCRM | Published03/19/2026 | SeverityMedium |
CVE-2026-29097SuiteCRM Server-Side Request Forgery and Denial of Service via RSS Feed Dashlet | Exploitation statusNot known exploited | FixNot confirmed | Affected productSuiteCRM | Published03/19/2026 | SeverityHigh |
CVE-2026-29096SuiteCRM vulnerable to Authenticated SQL Injection via unsanitized field_function in Report Fields | Exploitation statusNot known exploited | FixNot confirmed | Affected productSuiteCRM | Published03/19/2026 | SeverityHigh |
CVE-2025-64493SuiteCRM is Vulnerable to Authenticated Blind SQL Injection via GraphQL | Exploitation statusPublic exploit | FixYes | Affected productSuiteCRM-Core | Published11/08/2025 | SeverityMedium |
CVE-2025-64492SuiteCRM is Vulnerable to Authenticated Time Based Blind SQL Injection | Exploitation statusNot known exploited | FixYes | Affected productSuiteCRM-Core | Published11/08/2025 | SeverityHigh |
CVE-2025-64491SuiteCRM is vulnerable to unauthenticated reflected XSS through its Login page | Exploitation statusPublic exploit | FixYes | Affected productSuiteCRM | Published11/08/2025 | SeverityMedium |
CVE-2025-64490SuiteCRM's Inconsistent RBAC Enforcement Enables Access Control Bypass | Exploitation statusNot known exploited | FixYes | Affected productSuiteCRM | Published11/08/2025 | SeverityHigh |
CVE-2025-64489SuiteCRM: Privilege Escalation via Improper Session Invalidation and Inactive User Bypass | Exploitation statusNot known exploited | FixYes | Affected productSuiteCRM | Published11/08/2025 | SeverityHigh |
CVE-2025-64488SuiteCRM: Authenticated SQL Injection Possible in Reschedule Call Module | Exploitation statusNot known exploited | FixYes | Affected productSuiteCRM | Published11/07/2025 | SeverityHigh |
CVE-2022-50590SuiteCRM < 7.12.6 Type Confusion via 'deleteAttachment' Functionality | Exploitation statusNot known exploited | FixYes | Affected productSuiteCRM | Published11/06/2025 | SeverityHigh |
CVE-2022-50589SuiteCRM < 7.12.6 SQL Injection via 'export' Functionality | Exploitation statusNot known exploited | FixYes | Affected productSuiteCRM | Published11/06/2025 | SeverityCritical |
CVE-2025-41384Reflected Cross-Site Scripting (XSS) in SuiteCRM | Exploitation statusNot known exploited | FixYes | Affected productSuiteCRM | Published10/27/2025 | SeverityMedium |
CVE-2025-54787SuiteCRM: Improper Authorization for attachment downloads | Exploitation statusNot known exploited | FixYes | Affected productSuiteCRM | Published08/07/2025 | SeverityLow |
CVE-2025-54784SuiteCRM is vulnerable to Cross Site Scripting (XSS) through its email viewer | Exploitation statusNot known exploited | FixYes | Affected productSuiteCRM | Published08/07/2025 | SeverityHigh |
CVE-2025-54783SuiteCRM: Reflected Cross Site Scripting (XSS) through HTTP Referrer header | Exploitation statusNot known exploited | FixYes | Affected productSuiteCRM | Published08/07/2025 | SeverityMedium |
CVE-2025-54788SuiteCRM: Authenticated Blind SQL Injection in InboundEmail module | Exploitation statusNot known exploited | FixYes | Affected productSuiteCRM | Published08/06/2025 | SeverityHigh |
CVE-2025-54786SuiteCRM: Legacy iCal service allows unauthenticated access to meeting data | Exploitation statusNot known exploited | FixYes | Affected productSuiteCRM-Core | Published08/06/2025 | SeverityMedium |
CVE-2025-54785SuiteCRM is Vulnerable to PHP Object Injection in Reports | Exploitation statusNot known exploited | FixYes | Affected productSuiteCRM | Published08/06/2025 | SeverityHigh |
CVE-2019-18785 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published03/20/2020 | SeverityUnknown |
CyStack VulnScan continuously discovers assets, validates vulnerabilities, and helps security teams prioritize remediation across the organization.
Explore CyStack VulnScan
