s
sugarcrm
Security Risk Profile
74
/100
highSecurity Risk Score
Comprehensive risk assessment based on 71 vulnerabilities, EPSS scores, exploitation status, and remediation availability.
📅 Data spans from December 15, 2004 to present
71
Total CVEs
50
Critical+High
2
Exploited
47
Unpatched
Threat Assessment
Avg CVSS
7.6
Base severity
Avg EPSS
0%
Exploit probability
Unpatched
47
Critical/High
Risk Level
74/100
high
⚠️ 2 Active Exploits
Severity Distribution
Critical
7High
43Medium
20Low
0Exploit Likelihood
>50% chance
020-50%
05-20%
0<5%
0Age Distribution
Common Weaknesses (CWE)
1
Code Injection
17
2
SQL Injection
16
3
Input Validation
11
4
XSS
11
5
Path Traversal
5
Most Affected Products
1. SugarCRM SugarCRM523
2. SugarCRM Sugar Suite11
3. SugarCRM Sugar Sales2
4. SugarCRM Multiple Products1
5. debian1
Recent Vulnerabilities
See more →https://reddit.com/r/netsec/comments/1lzgkiv/cve202458258_sugarcrm_1400_csspreview_less_code/
unknown
[CVE-2024-58258] SugarCRM <= 14.0.0 (css/preview) LESS Code Injection Vulnerability
Jul 14, 2025🔧 No Patch
CVE-2024-58258
CVSS 7.2high
Jul 13, 2025⚠ Exploited🔧 No Patch
CVE-2025-25034
CVSS 9.3critical
SugarCRM PHP Deserialization RCE
Jun 20, 2025🔧 No Patch
CVE-2023-46816
CVSS 8.8high
Oct 27, 2023🔧 No Patch
CVE-2023-46815
CVSS 8.8high
Oct 27, 2023🔧 No Patch
CVE-2023-35808
CVSS 8.8high
Jun 17, 2023🔧 No Patch
CVE-2023-35811
CVSS 8.8high
Jun 17, 2023🔧 No Patch
CVE-2023-35810
CVSS 7.2high
Jun 17, 2023🔧 No Patch
CVE-2023-35809
CVSS 8.8high
Jun 17, 2023🔧 No Patch
CVE-2023-22952
CVSS 8.8high
Multiple SugarCRM Products Remote Code Execution Vulnerability
Jan 11, 2023⚠ Exploited🔧 No Patch
Monitor sugarcrm in Real-Time
Get instant alerts when new vulnerabilities are discovered. Stay ahead of security threats with SecAlerts.