Suitecrm vulnerabilities
68 published CVEs name Suitecrm among the affected products.
- 68Published CVEs68 of them scored
- 53Last 12 monthspublished in the last year
- 4Critical42 more rated high
- 0Known exploitedin CISA's KEV catalog
Newest CVEs
- CVE-2026-100358
SuiteCRM: Admin OS RCE via Dropdown Editor PHP Injection
SuiteCRM · SuiteCRM
Critical9.4 - CVE-2026-100363
SuiteCRM: Privilege escalation via V8 REST modules (ACLRoles, ACLActions, Administration)
SuiteCRM · SuiteCRM
High8.8 - CVE-2026-100359
SuiteCRM: Authenticated SQL Injection In action_get_end_date function
SuiteCRM · SuiteCRM
Medium6.5 - CVE-2026-100362
SuiteCRM: V8 OAuth2 Username Enumeration
SuiteCRM · SuiteCRM
Medium6.9 - CVE-2026-97377
SuiteCRM: Authenticated SQL Injection in SOAP Portal Method portal_get_entry_list
SuiteCRM · SuiteCRM
High8.8 - CVE-2026-100360
SuiteCRM: V8 API Relationship Delete Bypasses Object-Level Authorization on the Related Record
SuiteCRM · SuiteCRM
High7.1 - CVE-2026-100361
SuiteCRM: Mass Assignment in V8 API Allows Modification of Sensitive User Fields (user_hash, external_auth_only)
SuiteCRM · SuiteCRM
High7.1 - CVE-2026-100364
SuiteCRM V8 JSON:API processAttributes() Missing ID Filter Allows ACL Bypass and Record Ownership Hijack
SuiteCRM · SuiteCRM
High7.1 - CVE-2026-100365
SuiteCRM: Time-Based Blind SQL Injection via AOR_Reports ORDER BY Clause Allows Data Exfiltration by Any Authenticated User
SuiteCRM · SuiteCRM
High8.8 - CVE-2026-71548
SuiteCRM: Authenticated SQL Injection in AOR_Reports `parameter_value` (value_type=Field) allows any low-privileged user to read the full database
SuiteCRM · SuiteCRM
High8.8