Vulnerabilidades en SuiteCRM
68 resultadosCVE-2026-63111HIGHSuiteCRM: Non-admin user creates SchedulersJob: SSRF via cronEPSS 0.3%CVE-2026-61651HIGHSuiteCRM: Authenticated SQL Injection in get_end_date function in Project ControllerEPSS 0.3%CVE-2026-100361HIGHSuiteCRM: Mass Assignment in V8 API Allows Modification of Sensitive User Fields (user_hash, external_auth_only)EPSS 0.3%CVE-2026-63217MEDIUMSuiteCRM: IDOR in generatePdf Entry Point Allows Record Data ExfiltrationEPSS 0.3%CVE-2026-69140HIGHSuiteCRM: SQL injection via get_latest_for_id param in GetLatestRevision.phpEPSS 0.3%CVE-2026-32697MEDIUMSuiteCRM: RecordHandler::getRecord() missing ACLAccess('view') check allows any authenticated user to read any record (IDOR)EPSS 0.3%CVE-2026-100359MEDIUMSuiteCRM: Authenticated SQL Injection In action_get_end_date functionEPSS 0.3%CVE-2026-69135HIGHSuiteCRM: Authenticated SQL Injection In Project ModuleEPSS 0.3%CVE-2025-64490HIGHSuiteCRM's Inconsistent RBAC Enforcement Enables Access Control BypassEPSS 0.3%CVE-2026-71548HIGHSuiteCRM: Authenticated SQL Injection in AOR_Reports `parameter_value` (value_type=Field) allows any low-privileged user to read the full databaseEPSS 0.3%CVE-2026-29099HIGHSuiteCRM has Authenticated Blind SQL Injection in OutboundEmail Legacy Functionality.EPSS 0.3%CVE-2025-54787LOWSuiteCRM: Improper Authorization for attachment downloadsEPSS 0.3%CVE-2026-69145MEDIUMSuiteCRM: AOR Reports aor_fields.field SQL InjectionEPSS 0.3%CVE-2026-108713MEDIUMSuiteCRM through 7.15.2 and 8.10.2 Missing Authorization via setCampaignMarketingAndTemplateEPSS 0.3%CVE-2026-61648HIGHSuiteCRM: SQL injection via parameter_value[0] param in AOR_Report.phpEPSS 0.2%CVE-2026-61653HIGHSuiteCRM: SQL injection via id param in modules/Campaigns/PopupCampaignRoi.phpEPSS 0.2%CVE-2025-54783MEDIUMSuiteCRM: Reflected Cross Site Scripting (XSS) through HTTP Referrer headerEPSS 0.2%CVE-2025-54784HIGHSuiteCRM is vulnerable to Cross Site Scripting (XSS) through its email viewerEPSS 0.2%CVE-2026-29104LOWSuiteCRM Vulnerable to Authenticated Arbitrary File Upload via Configurator addfontresult View in SuiteCRMEPSS 0.2%CVE-2026-100364HIGHSuiteCRM V8 JSON:API processAttributes() Missing ID Filter Allows ACL Bypass and Record Ownership HijackEPSS 0.2%