CVE-2026-71548highCWE-20CWE-89

CVE-2026-71548: falha de alta gravidade em SuiteCRM

SuiteCRM: Authenticated SQL Injection in AOR_Reports `parameter_value` (value_type=Field) allows any low-privileged user to read the full database

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar SuiteCRM

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

21Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 8.8epss 0.3%
SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to 7.15.2 and 8.10.2, AOR_Report::build_report_query_where incorporates a report editor's parameter_value when value_type=Field without sufficient validation. An authenticated user who can save a report can use SQL injection to read the entire SuiteCRM database. Disclosed data can include users.user_hash, OAuth2 tokens, CRM records, report definitions, and configuration data; the connector does not permit stacked queries, so direct write-through-injection is not supported. This issue is fixed in versions 7.15.2 and 8.10.2.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Produtos afetados
SuiteCRM · SuiteCRM
CVEs relacionadas — SuiteCRM

No mesmo produto, das mais perigosas para as menos.

CVE-2026-69137HIGHSuiteCRM: Authenticated SSRF in CalendarAccount testConnection Allows Internal Network Access and Response DisclosureEPSS 3.8%CVE-2026-33289HIGHSuiterCRM has LDAP Filter Injection in Authentication ModuleEPSS 0.7%CVE-2022-50589CRITICALSuiteCRM < 7.12.6 SQL Injection via 'export' FunctionalityEPSS 0.7%CVE-2026-63213HIGHSuiteCRM: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in SuiteCRMEPSS 0.6%CVE-2026-29103CRITICALSuiteCRM Vulnerable to Remote Code Execution via Module Loader Package Scanner BypassEPSS 0.5%CVE-2026-29102HIGHSuiteCRM has Authenticated RCE in ModulesEPSS 0.5%