Where
AND
-Infinity
0

Trending

Last week
Last month
Last year

SugarCRM SugarCRMInput Validation, Code Injection

Risk 86
Severity
9.8
Input Validation, Code Injection
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

An authorization bypass and PHP local-file-include vulnerability in the installation component of SugarCRM before 8.0, 8.0 before 8.0.7, 9.0 before 9.0.4, and 10.0 before 10.0.0 allows for unauthenticated remote code execution against a configured SugarCRM instance via crafted HTTP requests. (This is exploitable even after installation is completed.).

First published (updated )
CVE-2020-7472

SugarCRM SugarCRMSQL Injection

Risk 79
Severity
8.8
SQL Injection
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

SugarCRM before 8.0.4 and 9.x before 9.0.2 allows SQL injection in the pmseInbox module by a Regular user.

First published (updated )
CVE-2019-17318

SugarCRM SugarCRMCode Injection

Risk 79
Severity
8.8
Code Injection
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

SugarCRM before 8.0.4 and 9.x before 9.0.2 allows PHP code injection in the Emails module by a Regular user.

First published (updated )
CVE-2019-17308

SugarCRM SugarCRMSQL Injection

Risk 79
Severity
8.8
SQL Injection
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

SugarCRM before 8.0.4 and 9.x before 9.0.2 allows SQL injection in the pmseProject module by a Regular user.

First published (updated )
CVE-2019-17293

SugarCRM SugarCRMCode Injection

Risk 79
Severity
8.8
Code Injection
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

SugarCRM before 8.0.4 and 9.x before 9.0.2 allows PHP code injection in the Administration module by a Developer user.

First published (updated )
CVE-2019-17300

SugarCRM SugarCRMSQL Injection

Risk 79
Severity
8.8
SQL Injection
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

SugarCRM before 8.0.4 and 9.x before 9.0.2 allows SQL injection in the history function by a Regular user.

First published (updated )
CVE-2019-17295

SugarCRM SugarCRMSQL Injection

Risk 79
Severity
8.8
SQL Injection
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

SugarCRM before 8.0.4 and 9.x before 9.0.2 allows SQL injection in the Quotes module by a Regular user.

First published (updated )
CVE-2019-17297

SugarCRM SugarCRMCode Injection

Risk 79
Severity
8.8
Code Injection
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

SugarCRM before 8.0.4 and 9.x before 9.0.2 allows PHP code injection in the MergeRecords module by a Developer user.

First published (updated )
CVE-2019-17303

SugarCRM SugarCRMSQL Injection

Risk 79
Severity
8.8
SQL Injection
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

SugarCRM before 8.0.4 and 9.x before 9.0.2 allows SQL injection in the Administration module by a Developer user.

First published (updated )
CVE-2019-17298

SugarCRM SugarCRMSQL Injection

Risk 79
Severity
8.8
SQL Injection
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

SugarCRM before 8.0.4 and 9.x before 9.0.2 allows SQL injection in the export function by a Regular user.

First published (updated )
CVE-2019-17294

SugarCRM SugarCRMPath Traversal

Risk 79
Severity
8.8
Path Traversal
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

SugarCRM before 8.0.4 and 9.x before 9.0.2 allows directory traversal in the attachment function by a Regular user.

First published (updated )
CVE-2019-17311

SugarCRM SugarCRMSQL Injection

Risk 79
Severity
8.8
SQL Injection
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

SugarCRM before 8.0.4 and 9.x before 9.0.2 allows SQL injection in the Contacts module by a Regular user.

First published (updated )
CVE-2019-17296

SugarCRM SugarCRMCode Injection

Risk 79
Severity
8.8
Code Injection
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

SugarCRM before 8.0.4 and 9.x before 9.0.2 allows PHP code injection in the ModuleBuilder module by a Developer user.

First published (updated )
CVE-2019-17302

SugarCRM SugarCRMPath Traversal

Risk 79
Severity
8.8
Path Traversal
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

SugarCRM before 8.0.4 and 9.x before 9.0.2 allows directory traversal in the Studio module by a Developer user.

First published (updated )
CVE-2019-17313

SugarCRM SugarCRMSQL Injection

Risk 79
Severity
8.8
SQL Injection
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

SugarCRM before 8.0.4 and 9.x before 9.0.2 allows SQL injection in the Emails module by a Regular user.

First published (updated )
CVE-2019-17319

SugarCRM SugarCRMPath Traversal

Risk 79
Severity
8.8
Path Traversal
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

SugarCRM before 8.0.4 and 9.x before 9.0.2 allows directory traversal in the file function by a Regular user.

First published (updated )
CVE-2019-17312

SugarCRM SugarCRMCode Injection

Risk 79
Severity
8.8
Code Injection
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

SugarCRM before 8.0.4 and 9.x before 9.0.2 allows PHP code injection in the MergeRecords module by a Regular user.

First published (updated )
CVE-2019-17305

SugarCRM SugarCRMSugarCRM before 8.0.4 and 9.x before 9.0.2 allows PHP object injection in the Import module by a Reg…

Risk 79
Severity
8.8
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

SugarCRM before 8.0.4 and 9.x before 9.0.2 allows PHP object injection in the Import module by a Regular user.

First published (updated )
CVE-2019-17316

SugarCRM SugarCRMCode Injection

Risk 66
Severity
7.2
Code Injection
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

SugarCRM before 8.0.4 and 9.x before 9.0.2 allows PHP code injection in the ModuleBuilder module by an Admin user.

First published (updated )
CVE-2019-17301

SugarCRM SugarCRMSQL Injection

Risk 66
Severity
7.2
SQL Injection
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

SugarCRM before 8.0.4 and 9.x before 9.0.2 allows SQL injection in the pmseInbox module by an Admin user.

First published (updated )
CVE-2019-17292

SugarCRM SugarCRMPath Traversal

Risk 66
Severity
7.2
Path Traversal
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

SugarCRM before 8.0.4 and 9.x before 9.0.2 allows directory traversal in the Configurator module by an Admin user.

First published (updated )
CVE-2019-17314

SugarCRM SugarCRMCode Injection

Risk 66
Severity
7.2
Code Injection
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

SugarCRM before 8.0.4 and 9.x before 9.0.2 allows PHP code injection in the EmailMan module by an Admin user.

First published (updated )
CVE-2019-17309

SugarCRM SugarCRMCode Injection

Risk 66
Severity
7.2
Code Injection
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

SugarCRM before 8.0.4 and 9.x before 9.0.2 allows PHP code injection in the Tracker module by an Admin user.

First published (updated )
CVE-2019-17307

SugarCRM SugarCRMCode Injection

Risk 66
Severity
7.2
Code Injection
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

SugarCRM before 8.0.4 and 9.x before 9.0.2 allows PHP code injection in the MergeRecords module by an Admin user.

First published (updated )
CVE-2019-17304

SugarCRM SugarCRMCode Injection

Risk 66
Severity
7.2
Code Injection
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

SugarCRM before 8.0.4 and 9.x before 9.0.2 allows PHP code injection in the Campaigns module by an Admin user.

First published (updated )
CVE-2019-17310

SugarCRM SugarCRMCode Injection

Risk 66
Severity
7.2
Code Injection
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

SugarCRM before 8.0.4 and 9.x before 9.0.2 allows PHP code injection in the Configurator module by an Admin user.

First published (updated )
CVE-2019-17306

SugarCRM SugarCRMCode Injection

Risk 66
Severity
7.2
Code Injection
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

SugarCRM before 8.0.4 and 9.x before 9.0.2 allows PHP code injection in the Administration module by an Admin user.

First published (updated )
CVE-2019-17299

SugarCRM SugarCRMSugarCRM before 8.0.4 and 9.x before 9.0.2 allows PHP object injection in the Administration module …

Risk 66
Severity
7.2
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

SugarCRM before 8.0.4 and 9.x before 9.0.2 allows PHP object injection in the Administration module by an Admin user.

First published (updated )
CVE-2019-17315

SugarCRM SugarCRMSugarCRM before 8.0.4 and 9.x before 9.0.2 allows PHP object injection in the UpgradeWizard module b…

Risk 66
Severity
7.2
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

SugarCRM before 8.0.4 and 9.x before 9.0.2 allows PHP object injection in the UpgradeWizard module by an Admin user.

First published (updated )
CVE-2019-17317

SugarCRM SugarCRMXSS

Risk 38
Severity
6.1
XSS
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

SugarCRM Enterprise 9.0.0 allows mobile/error-not-supported-platform.html?desktopurl= XSS.

First published (updated )
CVE-2019-14974

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203