SuiteCRM vulnerabilities and fixes
Exploited and high-severity SuiteCRM vulnerabilities tracked by VulnFeed, with CVSS and EPSS scores, affected versions and fixes.
- 8.8CVE-2026-97377SuiteCRM: Authenticated SQL Injection in SOAP Portal Method portal_get_entry_listVerify fixSuiteCRM SuiteCRM
1 min read - 8.3CVE-2026-69141SuiteCRM: SQL injection via search param in modules/Cases/controller.phpVerify fixSuiteCRM SuiteCRM
1 min read - 8.8CVE-2026-69142SuiteCRM: Authenticated SQL Injection in map_markers distance ParameterVerify fixSuiteCRM SuiteCRM
1 min read - 7.1CVE-2026-100364SuiteCRM V8 JSON:API processAttributes() Missing ID Filter Allows ACL Bypass and Record Ownership HijackVerify fixSuiteCRM SuiteCRM
1 min read - 7.1CVE-2026-100360SuiteCRM: V8 API Relationship Delete Bypasses Object-Level Authorization on the Related RecordVerify fixSuiteCRM SuiteCRM
1 min read - 7.1CVE-2026-100361SuiteCRM: Mass Assignment in V8 API Allows Modification of Sensitive User Fields (user_hash, external_auth_only)Verify fixSuiteCRM SuiteCRM
1 min read - 9.4CVE-2026-100358SuiteCRM: Admin OS RCE via Dropdown Editor PHP InjectionRCEVerify fixSuiteCRM SuiteCRM
1 min read - 8.8CVE-2026-100363SuiteCRM: Privilege escalation via V8 REST modules (ACLRoles, ACLActions, Administration)Verify fixSuiteCRM SuiteCRM
1 min read - 8.8CVE-2026-100365SuiteCRM: Time-Based Blind SQL Injection via AOR_Reports ORDER BY Clause Allows Data Exfiltration by Any Authenticated UserVerify fixSuiteCRM SuiteCRM
1 min read - 8.8CVE-2026-71548SuiteCRM: Authenticated SQL Injection in AOR_Reports `parameter_value` (value_type=Field) allows any low-privileged user to read the full databaseVerify fixSuiteCRM SuiteCRM
1 min read - 9.9CVE-2026-71550SuiteCRM: LFI to RCE via AOW_WorkFlowVerify fixSuiteCRM SuiteCRM
1 min read - 8.8CVE-2026-69134SuiteCRM: SQL Injection via REST API securexss() Bypass in Relationship ManagementVerify fixSuiteCRM SuiteCRM
1 min read - 8.3CVE-2026-69140SuiteCRM: SQL injection via get_latest_for_id param in GetLatestRevision.phpVerify fixSuiteCRM SuiteCRM
1 min read - 7.1CVE-2026-69136SuiteCRM: Authenticated SQL Injection In handleAttachments functionVerify fixSuiteCRM SuiteCRM
1 min read - 7.1CVE-2026-69135SuiteCRM: Authenticated SQL Injection In Project ModuleVerify fixSuiteCRM SuiteCRM
1 min read - 7.7CVE-2026-69137SuiteCRM: Authenticated SSRF in CalendarAccount testConnection Allows Internal Network Access and Response DisclosureVerify fixSuiteCRM SuiteCRM
1 min read - 8.3CVE-2026-61648SuiteCRM: SQL injection via parameter_value[0] param in AOR_Report.phpVerify fixSuiteCRM SuiteCRM
1 min read - 8.1CVE-2026-61650SuiteCRM: Incorrect Access Control in V8 relationship creation via missing edit authorizationVerify fixSuiteCRM SuiteCRM
1 min read - 8.3CVE-2026-61653SuiteCRM: SQL injection via id param in modules/Campaigns/PopupCampaignRoi.phpVerify fixSuiteCRM SuiteCRM
1 min read - 7.2CVE-2026-63213SuiteCRM: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in SuiteCRMVerify fixSuiteCRM SuiteCRM
1 min read - 7.7CVE-2026-61649SuiteCRM: isSelfRequest() bypass via substring match allows SSRF to internal servicesVerify fixSuiteCRM SuiteCRM
1 min read - 8.3CVE-2026-63215SuiteCRM: Time-Based Blind SQL Injection via REST APIVerify fixSuiteCRM SuiteCRM
1 min read - 8.8CVE-2026-63214SuiteCRM: Authenticated SQL Injection in v4_1 get_entry_list rest apiVerify fixSuiteCRM SuiteCRM
1 min read - 8.3CVE-2026-61651SuiteCRM: Authenticated SQL Injection in get_end_date function in Project ControllerVerify fixSuiteCRM SuiteCRM
1 min read - 7.1CVE-2026-63111SuiteCRM: Non-admin user creates SchedulersJob: SSRF via cronVerify fixSuiteCRM SuiteCRM
1 min read