Vulnerabilidades em SuiteCRM
68 resultadosAnálise Vexday
SuiteCRM apresenta 33 vulnerabilidades catalogadas, predominantemente injeção SQL (CWE-89), sem registros de exploração ativa em campo. Embora 2 sejam classificadas como críticas, a ausência de atividade recente (nenhuma publicação nos últimos 90 dias e zero CVEs em exploração) sugere risco controlado para ambientes com patch management atualizado.
CVE-2025-64492HIGHSuiteCRM is Vulnerable to Authenticated Time Based Blind SQL InjectionEPSS 0.4%CVE-2025-64489HIGHSuiteCRM: Privilege Escalation via Improper Session Invalidation and Inactive User BypassEPSS 0.4%CVE-2019-25663HIGHSuiteCRM 7.10.7 SQL Injection via parentTab ParameterEPSS 0.4%CVE-2019-25664HIGHSuiteCRM 7.10.7 SQL Injection via record ParameterEPSS 0.4%CVE-2026-69142HIGHSuiteCRM: Authenticated SQL Injection in map_markers distance ParameterEPSS 0.4%CVE-2026-69134HIGHSuiteCRM: SQL Injection via REST API securexss() Bypass in Relationship ManagementEPSS 0.4%CVE-2026-100360HIGHSuiteCRM: V8 API Relationship Delete Bypasses Object-Level Authorization on the Related RecordEPSS 0.4%CVE-2025-64493MEDIUMSuiteCRM is Vulnerable to Authenticated Blind SQL Injection via GraphQLEPSS 0.4%CVE-2026-29098MEDIUMSuiteCRM has Relative Path Traversal via ModuleBuilder Modules ExportCustom ActionEPSS 0.3%CVE-2026-108712MEDIUMSuiteCRM through 7.15.2 and 8.10.2 Missing Authorization via DetailUserRole Entry PointEPSS 0.3%CVE-2026-29189HIGHSuiteCRM has a REST API V8 IDOR: Missing ACL Checks on User Preferences and Relationship EndpointsEPSS 0.3%CVE-2026-69141HIGHSuiteCRM: SQL injection via search param in modules/Cases/controller.phpEPSS 0.3%CVE-2026-100363HIGHSuiteCRM: Privilege escalation via V8 REST modules (ACLRoles, ACLActions, Administration)EPSS 0.3%CVE-2026-29096HIGHSuiteCRM vulnerable to Authenticated SQL Injection via unsanitized field_function in Report FieldsEPSS 0.3%CVE-2026-29108MEDIUMAuthenticated SuiteCRM Users Can Retrieve The Password Hash of Any UserEPSS 0.3%CVE-2026-63215HIGHSuiteCRM: Time-Based Blind SQL Injection via REST APIEPSS 0.3%CVE-2026-61649HIGHSuiteCRM: isSelfRequest() bypass via substring match allows SSRF to internal servicesEPSS 0.3%CVE-2025-54786MEDIUMSuiteCRM: Legacy iCal service allows unauthenticated access to meeting dataEPSS 0.3%CVE-2026-69144MEDIUMSuiteCRM: Authorization Bypass via Document Revision ID Confusion in download.phpEPSS 0.3%CVE-2026-29097HIGHSuiteCRM Server-Side Request Forgery and Denial of Service via RSS Feed DashletEPSS 0.3%