Latest sugarcrm sugarcrm Vulnerabilities

● CVE-2023-46816
An issue was discovered in SugarCRM 12 before 12.0.4 and 13 before 13.0.2. A Server Site Template Injection (SSTI) vulnerability has been identified in the GecControl action. By using a crafted reques...
Sugarcrm Sugarcrm>=12.0.0<12.0.4
Sugarcrm Sugarcrm>=12.0.0<12.0.4
Sugarcrm Sugarcrm>=12.0.0<12.0.4
Sugarcrm Sugarcrm=13.0.0
Sugarcrm Sugarcrm=13.0.0
Sugarcrm Sugarcrm=13.0.0
and 3 more
● CVE-2023-46815
An issue was discovered in SugarCRM 12 before 12.0.4 and 13 before 13.0.2. An Unrestricted File Upload vulnerability has been identified in the Notes module. By using a crafted request, custom PHP cod...
Sugarcrm Sugarcrm>=12.0.0<12.0.4
Sugarcrm Sugarcrm>=12.0.0<12.0.4
Sugarcrm Sugarcrm>=12.0.0<12.0.4
Sugarcrm Sugarcrm=13.0.0
Sugarcrm Sugarcrm=13.0.0
Sugarcrm Sugarcrm=13.0.0
and 3 more
● CVE-2023-35811
An issue was discovered in SugarCRM Enterprise before 11.0.6 and 12.x before 12.0.3. Two SQL Injection vectors have been identified in the REST API. By using crafted requests, custom SQL code can be i...
Sugarcrm Sugarcrm>=11.0.0<11.0.6
Sugarcrm Sugarcrm>=11.0.0<11.0.6
Sugarcrm Sugarcrm>=11.0.0<11.0.6
Sugarcrm Sugarcrm>=11.0.0<11.0.6
Sugarcrm Sugarcrm>=11.0.0<11.0.6
Sugarcrm Sugarcrm>=12.0.0<12.0.3
and 2 more
● CVE-2023-35810
An issue was discovered in SugarCRM Enterprise before 11.0.6 and 12.x before 12.0.3. A Second-Order PHP Object Injection vulnerability has been identified in the DocuSign module. By using crafted requ...
Sugarcrm Sugarcrm>=11.0.0<11.0.6
Sugarcrm Sugarcrm>=11.0.0<11.0.6
Sugarcrm Sugarcrm>=11.0.0<11.0.6
Sugarcrm Sugarcrm>=11.0.0<11.0.6
Sugarcrm Sugarcrm>=11.0.0<11.0.6
Sugarcrm Sugarcrm>=12.0.0<12.0.3
and 2 more
● CVE-2023-35809
An issue was discovered in SugarCRM Enterprise before 11.0.6 and 12.x before 12.0.3. A Bean Manipulation vulnerability has been identified in the REST API. By using a crafted request, custom PHP code ...
Sugarcrm Sugarcrm>=11.0.0<11.0.6
Sugarcrm Sugarcrm>=11.0.0<11.0.6
Sugarcrm Sugarcrm>=11.0.0<11.0.6
Sugarcrm Sugarcrm>=11.0.0<11.0.6
Sugarcrm Sugarcrm>=11.0.0<11.0.6
Sugarcrm Sugarcrm>=12.0.0<12.0.3
and 2 more
● CVE-2023-35808
An issue was discovered in SugarCRM Enterprise before 11.0.6 and 12.x before 12.0.3. An Unrestricted File Upload vulnerability has been identified in the Notes module. By using crafted requests, custo...
Sugarcrm Sugarcrm>=11.0.0<11.0.6
Sugarcrm Sugarcrm>=11.0.0<11.0.6
Sugarcrm Sugarcrm>=11.0.0<11.0.6
Sugarcrm Sugarcrm>=11.0.0<11.0.6
Sugarcrm Sugarcrm>=11.0.0<11.0.6
Sugarcrm Sugarcrm>=12.0.0<12.0.3
and 2 more
● CVE-2023-22952
Multiple SugarCRM Products Remote Code Execution Vulnerability
Sugarcrm Sugarcrm>=11.0.0<11.0.5
Sugarcrm Sugarcrm>=12.0.0<12.0.2
● CVE-2020-36501
Multiple cross-site scripting (XSS) vulnerabilities in the Support module of SugarCRM v6.5.18 allows attackers to execute arbitrary web scripts or HTML via crafted payloads entered into the primary ad...
Sugarcrm Sugarcrm=6.5.18
● CVE-2020-28956
Multiple cross-site scripting (XSS) vulnerabilities in the Sales module of SugarCRM v6.5.18 allows attackers to execute arbitrary web scripts or HTML via crafted payloads entered into the primary addr...
Sugarcrm Sugarcrm=6.5.18
● CVE-2020-28955
SugarCRM v6.5.18 was discovered to contain a cross-site scripting (XSS) vulnerability in the Create Employee module. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a ...
Sugarcrm Sugarcrm=6.5.18
● CVE-2020-17372
SugarCRM before 10.1.0 (Q3 2020) allows XSS.
Sugarcrm Sugarcrm<10.1.0
● CVE-2020-17373
SugarCRM before 10.1.0 (Q3 2020) allows SQL Injection.
Sugarcrm Sugarcrm<10.1.0
● CVE-2012-0694
SugarCRM CE <= 6.3.1 contains scripts that use "unserialize()" with user controlled input which allows remote attackers to execute arbitrary PHP code.
debian
Sugarcrm Sugarcrm<=6.3.1
● CVE-2019-17314
SugarCRM before 8.0.4 and 9.x before 9.0.2 allows directory traversal in the Configurator module by an Admin user.
Sugarcrm Sugarcrm>=7.9.0.0<7.9.5.0
Sugarcrm Sugarcrm>=8.0.0<8.0.4
Sugarcrm Sugarcrm>=9.0.0<9.0.2
Sugarcrm Sugarcrm>=7.9.0.0<7.9.5.0
Sugarcrm Sugarcrm>=8.0.0<8.0.4
Sugarcrm Sugarcrm>=9.0.0<9.0.2
and 3 more
● CVE-2019-17311
SugarCRM before 8.0.4 and 9.x before 9.0.2 allows directory traversal in the attachment function by a Regular user.
Sugarcrm Sugarcrm>=7.9.0.0<7.9.5.0
Sugarcrm Sugarcrm>=8.0.0<8.0.4
Sugarcrm Sugarcrm>=9.0.0<9.0.2
Sugarcrm Sugarcrm>=7.9.0.0<7.9.5.0
Sugarcrm Sugarcrm>=8.0.0<8.0.4
Sugarcrm Sugarcrm>=9.0.0<9.0.2
and 3 more
● CVE-2019-17313
Sugarcrm Sugarcrm>=7.9.0.0<7.9.5.0
Sugarcrm Sugarcrm>=8.0.0<8.0.4
Sugarcrm Sugarcrm>=9.0.0<9.0.2
Sugarcrm Sugarcrm>=7.9.0.0<7.9.5.0
Sugarcrm Sugarcrm>=8.0.0<8.0.4
Sugarcrm Sugarcrm>=9.0.0<9.0.2
and 3 more
● CVE-2019-17299
SugarCRM before 8.0.4 and 9.x before 9.0.2 allows PHP code injection in the Administration module by an Admin user.
Sugarcrm Sugarcrm>=7.9.0.0<7.9.5.0
Sugarcrm Sugarcrm>=8.0.0<8.0.4
Sugarcrm Sugarcrm>=9.0.0<9.0.2
Sugarcrm Sugarcrm>=7.9.0.0<7.9.5.0
Sugarcrm Sugarcrm>=8.0.0<8.0.4
Sugarcrm Sugarcrm>=9.0.0<9.0.2
and 3 more
● CVE-2019-17308
SugarCRM before 8.0.4 and 9.x before 9.0.2 allows PHP code injection in the Emails module by a Regular user.
Sugarcrm Sugarcrm>=7.9.0.0<7.9.5.0
Sugarcrm Sugarcrm>=8.0.0<8.0.4
Sugarcrm Sugarcrm>=9.0.0<9.0.2
Sugarcrm Sugarcrm>=7.9.0.0<7.9.5.0
Sugarcrm Sugarcrm>=8.0.0<8.0.4
Sugarcrm Sugarcrm>=9.0.0<9.0.2
and 3 more
● CVE-2019-17301
SugarCRM before 8.0.4 and 9.x before 9.0.2 allows PHP code injection in the ModuleBuilder module by an Admin user.
Sugarcrm Sugarcrm>=7.9.0.0<7.9.5.0
Sugarcrm Sugarcrm>=8.0.0<8.0.4
Sugarcrm Sugarcrm>=9.0.0<9.0.2
Sugarcrm Sugarcrm>=7.9.0.0<7.9.5.0
Sugarcrm Sugarcrm>=8.0.0<8.0.4
Sugarcrm Sugarcrm>=9.0.0<9.0.2
and 3 more
● CVE-2019-17306
SugarCRM before 8.0.4 and 9.x before 9.0.2 allows PHP code injection in the Configurator module by an Admin user.
Sugarcrm Sugarcrm>=7.9.0.0<7.9.5.0
Sugarcrm Sugarcrm>=8.0.0<8.0.4
Sugarcrm Sugarcrm>=9.0.0<9.0.2
Sugarcrm Sugarcrm>=7.9.0.0<7.9.5.0
Sugarcrm Sugarcrm>=8.0.0<8.0.4
Sugarcrm Sugarcrm>=9.0.0<9.0.2
and 3 more
● CVE-2019-17298
SugarCRM before 8.0.4 and 9.x before 9.0.2 allows SQL injection in the Administration module by a Developer user.
Sugarcrm Sugarcrm>=7.9.0.0<7.9.5.0
Sugarcrm Sugarcrm>=8.0.0<8.0.4
Sugarcrm Sugarcrm>=9.0.0<9.0.2
Sugarcrm Sugarcrm>=7.9.0.0<7.9.5.0
Sugarcrm Sugarcrm>=8.0.0<8.0.4
Sugarcrm Sugarcrm>=9.0.0<9.0.2
and 3 more
● CVE-2019-17310
Sugarcrm Sugarcrm>=7.9.0.0<7.9.5.0
Sugarcrm Sugarcrm>=8.0.0<8.0.4
Sugarcrm Sugarcrm>=9.0.0<9.0.2
Sugarcrm Sugarcrm>=7.9.0.0<7.9.5.0
Sugarcrm Sugarcrm>=8.0.0<8.0.4
Sugarcrm Sugarcrm>=9.0.0<9.0.2
and 3 more
● CVE-2019-17305
SugarCRM before 8.0.4 and 9.x before 9.0.2 allows PHP code injection in the MergeRecords module by a Regular user.
Sugarcrm Sugarcrm>=7.9.0.0<7.9.5.0
Sugarcrm Sugarcrm>=8.0.0<8.0.4
Sugarcrm Sugarcrm>=9.0.0<9.0.2
Sugarcrm Sugarcrm>=7.9.0.0<7.9.5.0
Sugarcrm Sugarcrm>=8.0.0<8.0.4
Sugarcrm Sugarcrm>=9.0.0<9.0.2
and 3 more
● CVE-2019-17307
SugarCRM before 8.0.4 and 9.x before 9.0.2 allows PHP code injection in the Tracker module by an Admin user.
Sugarcrm Sugarcrm>=7.9.0.0<7.9.5.0
Sugarcrm Sugarcrm>=8.0.0<8.0.4
Sugarcrm Sugarcrm>=9.0.0<9.0.2
Sugarcrm Sugarcrm>=7.9.0.0<7.9.5.0
Sugarcrm Sugarcrm>=8.0.0<8.0.4
Sugarcrm Sugarcrm>=9.0.0<9.0.2
and 3 more
● CVE-2019-17302
SugarCRM before 8.0.4 and 9.x before 9.0.2 allows PHP code injection in the ModuleBuilder module by a Developer user.
Sugarcrm Sugarcrm>=7.9.0.0<7.9.5.0
Sugarcrm Sugarcrm>=8.0.0<8.0.4
Sugarcrm Sugarcrm>=9.0.0<9.0.2
Sugarcrm Sugarcrm>=7.9.0.0<7.9.5.0
Sugarcrm Sugarcrm>=8.0.0<8.0.4
Sugarcrm Sugarcrm>=9.0.0<9.0.2
and 3 more
● CVE-2019-17300
SugarCRM before 8.0.4 and 9.x before 9.0.2 allows PHP code injection in the Administration module by a Developer user.
Sugarcrm Sugarcrm>=7.9.0.0<7.9.5.0
Sugarcrm Sugarcrm>=8.0.0<8.0.4
Sugarcrm Sugarcrm>=9.0.0<9.0.2
Sugarcrm Sugarcrm>=7.9.0.0<7.9.5.0
Sugarcrm Sugarcrm>=8.0.0<8.0.4
Sugarcrm Sugarcrm>=9.0.0<9.0.2
and 3 more
● CVE-2019-17303
SugarCRM before 8.0.4 and 9.x before 9.0.2 allows PHP code injection in the MergeRecords module by a Developer user.
Sugarcrm Sugarcrm>=7.9.0.0<7.9.5.0
Sugarcrm Sugarcrm>=8.0.0<8.0.4
Sugarcrm Sugarcrm>=9.0.0<9.0.2
Sugarcrm Sugarcrm>=7.9.0.0<7.9.5.0
Sugarcrm Sugarcrm>=8.0.0<8.0.4
Sugarcrm Sugarcrm>=9.0.0<9.0.2
and 3 more
● CVE-2019-17309
SugarCRM before 8.0.4 and 9.x before 9.0.2 allows PHP code injection in the EmailMan module by an Admin user.
Sugarcrm Sugarcrm>=7.9.0.0<7.9.5.0
Sugarcrm Sugarcrm>=8.0.0<8.0.4
Sugarcrm Sugarcrm>=9.0.0<9.0.2
Sugarcrm Sugarcrm>=7.9.0.0<7.9.5.0
Sugarcrm Sugarcrm>=8.0.0<8.0.4
Sugarcrm Sugarcrm>=9.0.0<9.0.2
and 3 more
● CVE-2019-17304
SugarCRM before 8.0.4 and 9.x before 9.0.2 allows PHP code injection in the MergeRecords module by an Admin user.
Sugarcrm Sugarcrm>=7.9.0.0<7.9.5.0
Sugarcrm Sugarcrm>=8.0.0<8.0.4
Sugarcrm Sugarcrm>=9.0.0<9.0.2
Sugarcrm Sugarcrm>=7.9.0.0<7.9.5.0
Sugarcrm Sugarcrm>=8.0.0<8.0.4
Sugarcrm Sugarcrm>=9.0.0<9.0.2
and 3 more
● CVE-2019-17297
SugarCRM before 8.0.4 and 9.x before 9.0.2 allows SQL injection in the Quotes module by a Regular user.
Sugarcrm Sugarcrm>=7.9.0.0<7.9.5.0
Sugarcrm Sugarcrm>=8.0.0<8.0.4
Sugarcrm Sugarcrm>=9.0.0<9.0.2
Sugarcrm Sugarcrm>=7.9.0.0<7.9.5.0
Sugarcrm Sugarcrm>=8.0.0<8.0.4
Sugarcrm Sugarcrm>=9.0.0<9.0.2
and 3 more
● CVE-2019-17295
SugarCRM before 8.0.4 and 9.x before 9.0.2 allows SQL injection in the history function by a Regular user.
Sugarcrm Sugarcrm>=7.9.0.0<7.9.5.0
Sugarcrm Sugarcrm>=8.0.0<8.0.4
Sugarcrm Sugarcrm>=9.0.0<9.0.2
Sugarcrm Sugarcrm>=7.9.0.0<7.9.5.0
Sugarcrm Sugarcrm>=8.0.0<8.0.4
Sugarcrm Sugarcrm>=9.0.0<9.0.2
and 3 more
● CVE-2019-17292
SugarCRM before 8.0.4 and 9.x before 9.0.2 allows SQL injection in the pmse_Inbox module by an Admin user.
Sugarcrm Sugarcrm>=7.9.0.0<7.9.5.0
Sugarcrm Sugarcrm>=8.0.0<8.0.4
Sugarcrm Sugarcrm>=9.0.0<9.0.2
Sugarcrm Sugarcrm>=7.9.0.0<7.9.5.0
Sugarcrm Sugarcrm>=8.0.0<8.0.4
Sugarcrm Sugarcrm>=9.0.0<9.0.2
and 3 more
● CVE-2019-17294
SugarCRM before 8.0.4 and 9.x before 9.0.2 allows SQL injection in the export function by a Regular user.
Sugarcrm Sugarcrm>=7.9.0.0<7.9.5.0
Sugarcrm Sugarcrm>=8.0.0<8.0.4
Sugarcrm Sugarcrm>=9.0.0<9.0.2
Sugarcrm Sugarcrm>=7.9.0.0<7.9.5.0
Sugarcrm Sugarcrm>=8.0.0<8.0.4
Sugarcrm Sugarcrm>=9.0.0<9.0.2
and 3 more
● CVE-2019-17296
SugarCRM before 8.0.4 and 9.x before 9.0.2 allows SQL injection in the Contacts module by a Regular user.
Sugarcrm Sugarcrm>=7.9.0.0<7.9.5.0
Sugarcrm Sugarcrm>=8.0.0<8.0.4
Sugarcrm Sugarcrm>=9.0.0<9.0.2
Sugarcrm Sugarcrm>=7.9.0.0<7.9.5.0
Sugarcrm Sugarcrm>=8.0.0<8.0.4
Sugarcrm Sugarcrm>=9.0.0<9.0.2
and 3 more
● CVE-2019-17317
SugarCRM before 8.0.4 and 9.x before 9.0.2 allows PHP object injection in the UpgradeWizard module by an Admin user.
Sugarcrm Sugarcrm>=7.9.0.0<7.9.5.0
Sugarcrm Sugarcrm>=8.0.0<8.0.4
Sugarcrm Sugarcrm>=9.0.0<9.0.2
Sugarcrm Sugarcrm>=7.9.0.0<7.9.5.0
Sugarcrm Sugarcrm>=8.0.0<8.0.4
Sugarcrm Sugarcrm>=9.0.0<9.0.2
and 3 more
● CVE-2019-17319
Sugarcrm Sugarcrm>=7.9.0.0<7.9.5.0
Sugarcrm Sugarcrm>=8.0.0<8.0.4
Sugarcrm Sugarcrm>=9.0.0<9.0.2
Sugarcrm Sugarcrm>=7.9.0.0<7.9.5.0
Sugarcrm Sugarcrm>=8.0.0<8.0.4
Sugarcrm Sugarcrm>=9.0.0<9.0.2
and 3 more
● CVE-2019-17315
SugarCRM before 8.0.4 and 9.x before 9.0.2 allows PHP object injection in the Administration module by an Admin user.
Sugarcrm Sugarcrm>=7.9.0.0<7.9.5.0
Sugarcrm Sugarcrm>=8.0.0<8.0.4
Sugarcrm Sugarcrm>=9.0.0<9.0.2
Sugarcrm Sugarcrm>=7.9.0.0<7.9.5.0
Sugarcrm Sugarcrm>=8.0.0<8.0.4
Sugarcrm Sugarcrm>=9.0.0<9.0.2
and 3 more
● CVE-2019-14974
SugarCRM Enterprise 9.0.0 allows mobile/error-not-supported-platform.html?desktop_url= XSS.
Sugarcrm Sugarcrm=9.0.0
● CVE-2018-17784
Multiple vulnerabilities in YUI and FlashCanvas embedded in SugarCRM Community Edition 6.5.26 could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack on a target...
Sugarcrm Sugarcrm>=6.5.0<=6.5.26

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2024 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203