CVE-2026-29100: SuiteCRM has Reflected HTML Injection in Login Page via default_user_name Parameter
SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. SuiteCRM 7.15.0 contains a reflected HTML injection vulnerability in the login page that allows attackers to inject arbitrary HTML content, enabling phishing attacks and page defacement. Version 7.15.1 patches the issue.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-29100?
CVE-2026-29100 has a moderate severity level due to its potential for reflected HTML injection in the login page.
How do I fix CVE-2026-29100?
To fix CVE-2026-29100, upgrade SuiteCRM to version 7.15.1 or later where the vulnerability is addressed.
Who is affected by CVE-2026-29100?
CVE-2026-29100 affects users of SuiteCRM version 7.15.0.
What type of vulnerability is CVE-2026-29100?
CVE-2026-29100 is classified as a reflected HTML injection vulnerability.
Can attackers exploit CVE-2026-29100 without user interaction?
Yes, attackers can exploit CVE-2026-29100 by crafting malicious URLs that do not require user interaction.