What’s Vulnerable › Vulnerabilities
CVE-2026-29100: SuiteCRM has Reflected HTML Injection in Login Page via default_user_name Parameter
- Severity: medium (CVSS 6.1 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.2% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-03-19 · updated 2026-06-17
- Weakness: CWE-79
Description
SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. SuiteCRM 7.15.0 contains a reflected HTML injection vulnerability in the login page that allows attackers to inject arbitrary HTML content, enabling phishing attacks and page defacement. Version 7.15.1 patches the issue.
Affected products
- SuiteCRM: before 7.15.1 — fixed in 7.15.1
How to fix
Upgrade to a fixed version: SuiteCRM 7.15.1. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2026-29100 or the next vulnerability affects your stack