What’s Vulnerable › Products
salesagility SuiteCRM vulnerabilities
105 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 25 published in the last 12 months.
Check whether your salesagility SuiteCRM version is affected
Latest salesagility SuiteCRM vulnerabilities
- CVE-2019-25664 — SuiteCRM 7.10.7 SQL Injection via record Parameter (CVSS 7.1)
- CVE-2019-25663 — SuiteCRM 7.10.7 SQL Injection via parentTab Parameter (CVSS 7.1)
- CVE-2025-64493 — SuiteCRM is Vulnerable to Authenticated Blind SQL Injection via GraphQL (CVSS 6.5)
- CVE-2025-64492 — SuiteCRM is Vulnerable to Authenticated Time Based Blind SQL Injection (CVSS 8.8)
- CVE-2025-64491 — SuiteCRM is vulnerable to unauthenticated reflected XSS through its Login page (CVSS 6.1)
- CVE-2025-64490 — SuiteCRM's Inconsistent RBAC Enforcement Enables Access Control Bypass (CVSS 8.3)
- CVE-2025-64489 — SuiteCRM: Privilege Escalation via Improper Session Invalidation and Inactive User Bypass (CVSS 8.8)
- CVE-2025-64488 — SuiteCRM: Authenticated SQL Injection Possible in Reschedule Call Module (CVSS 8.8)
- CVE-2022-50590 — SuiteCRM < 7.12.6 Type Confusion via 'deleteAttachment' Functionality (CVSS 5.3)
- CVE-2022-50589 — SuiteCRM < 7.12.6 SQL Injection via 'export' Functionality (CVSS 9.8)
- CVE-2025-41384 — Reflected Cross-Site Scripting (XSS) in SuiteCRM (CVSS 6.1)
- CVE-2025-54787 — SuiteCRM: Improper Authorization for attachment downloads (CVSS 3.7)
- CVE-2025-54784 — SuiteCRM is vulnerable to Cross Site Scripting (XSS) through its email viewer (CVSS 6.1)
- CVE-2025-54783 — SuiteCRM: Reflected Cross Site Scripting (XSS) through HTTP Referrer header (CVSS 6.1)
- CVE-2025-54788 — SuiteCRM: Authenticated Blind SQL Injection in InboundEmail module (CVSS 8.8)
- CVE-2025-54786 — SuiteCRM: Legacy iCal service allows unauthenticated access to meeting data (CVSS 5.3)
- CVE-2025-54785 — SuiteCRM is Vulnerable to PHP Object Injection in Reports (CVSS 8.8)
- CVE-2022-45186 — (CVSS 8.1)
- CVE-2022-45185 — (CVSS 8.8)
- CVE-2024-50335 — Authenticated XSS in "Publish Key" Field Allowing Unauthorized Administrator User Creation in SuiteCRM (CVSS 5.4)
- CVE-2024-50333 — RCE in ModuleBuilder in SuiteCRM (CVSS 8.8)
- CVE-2024-50332 — Authenticated Blind SQL Injection in DeleteRelationShip in SuiteCRM (CVSS 8.8)
- CVE-2024-49774 — ModuleScanner flaws in SuiteCRM (CVSS 7.2)
- CVE-2024-49773 — Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in SuiteCRM (CVSS 6.5)
- CVE-2024-49772 — Authenticated SQL injection in AM_ProjectTemplates controller in SuiteCRM (CVSS 8.8)