Vulnerabilities in SuiteCRM
68 resultsCVE-2026-69137HIGHSuiteCRM: Authenticated SSRF in CalendarAccount testConnection Allows Internal Network Access and Response DisclosureEPSS 3.8%CVE-2026-33289HIGHSuiterCRM has LDAP Filter Injection in Authentication ModuleEPSS 0.7%CVE-2022-50589CRITICALSuiteCRM < 7.12.6 SQL Injection via 'export' FunctionalityEPSS 0.7%CVE-2026-63213HIGHSuiteCRM: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in SuiteCRMEPSS 0.6%CVE-2026-29103CRITICALSuiteCRM Vulnerable to Remote Code Execution via Module Loader Package Scanner BypassEPSS 0.5%CVE-2026-29102HIGHSuiteCRM has Authenticated RCE in ModulesEPSS 0.5%CVE-2026-29109HIGHSuiteCRM Authenticated Remote Code Execution via Unsafe Deserialization in SavedSearch Filter ProcessingEPSS 0.5%CVE-2025-54788HIGHSuiteCRM: Authenticated Blind SQL Injection in InboundEmail moduleEPSS 0.5%CVE-2026-29101MEDIUMSuiteCRM Vulnerable to Directory Traversal to DoS in ModulesEPSS 0.5%CVE-2026-63214HIGHSuiteCRM: Authenticated SQL Injection in v4_1 get_entry_list rest apiEPSS 0.5%CVE-2025-64488HIGHSuiteCRM: Authenticated SQL Injection Possible in Reschedule Call ModuleEPSS 0.5%CVE-2026-33288HIGHSuiteCRM has Authenticated SQL Injection in Authentication ModuleEPSS 0.5%CVE-2026-100365HIGHSuiteCRM: Time-Based Blind SQL Injection via AOR_Reports ORDER BY Clause Allows Data Exfiltration by Any Authenticated UserEPSS 0.4%CVE-2026-100362MEDIUMSuiteCRM: V8 OAuth2 Username EnumerationEPSS 0.4%CVE-2025-54785HIGHSuiteCRM is Vulnerable to PHP Object Injection in ReportsEPSS 0.4%CVE-2026-97377HIGHSuiteCRM: Authenticated SQL Injection in SOAP Portal Method portal_get_entry_listEPSS 0.4%CVE-2022-50590HIGHSuiteCRM < 7.12.6 Type Confusion via 'deleteAttachment' FunctionalityEPSS 0.4%CVE-2026-71550CRITICALSuiteCRM: LFI to RCE via AOW_WorkFlowEPSS 0.4%CVE-2026-63218MEDIUMSuiteCRM: Record-level Authorization Bypass via AOR_Reports changeReportPageEPSS 0.4%CVE-2026-100358CRITICALSuiteCRM: Admin OS RCE via Dropdown Editor PHP InjectionEPSS 0.4%