Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-69140— SuiteCRM: SQL injection via get_latest_for_id param in GetLatestRevision.php

Quick assessment

Affected
SuiteCRM SuiteCRM
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

SuiteCRM 是一款开源、面向企业级的客户关系管理（CRM）软件应用。在 7.15.2 和 8.10.2 版本之前，GetLatestRevision.php 会将 get_latest_for_id 参数直接拼接到 SQL UPDATE 语句中。尽管 securexss() 函数通常会对引号进行实体编码，但若输入内容以跨站脚本（XSS）载荷为前缀，AntiXSS 机制会错误地选择已处理的字符串而非编码后的备用值，从而导致字面意义上的引号进入 SQL 查询。拥有 Documents 模块访问权限的低权限用户可利

CVSS 8.3 · High

Affected Version Matrix 2

VendorProduct Version RangeStatus
SuiteCRM SuiteCRM < 7.15.2 affected
>= 8.0.0, < 8.10.2 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-69140

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
SuiteCRM: SQL injection via get_latest_for_id param in GetLatestRevision.php
Source: CVE Program / CVE List V5
Vulnerability Description
SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to 7.15.2 and 8.10.2, GetLatestRevision.php interpolates get_latest_for_id directly into an SQL UPDATE statement. Although securexss() normally entity-encodes quotes, an input prefixed with an XSS payload makes AntiXSS select a processed string instead of the encoded backup, allowing a literal quote to reach the query. A low-privileged user with Documents module access can disclose database data and mass-update linked_documents records, while stacked statements and arbitrary DROP or INSERT operations are not supported by this vector. This issue is fixed in versions 7.15.2 and 8.10.2.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L
Source: CVE Program / CVE List V5
Vulnerability Type
SQL命令中使用的特殊元素转义处理不恰当(SQL注入)
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
SuiteCRM SuiteCRM < 7.15.2 -

II. Public POCs for CVE-2026-69140

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-69140

请登录查看更多情报信息。

Other References for CVE-2026-69140 (5)

Same Patch Batch · SuiteCRM · 2026-11-05 · 31 CVEs total

CVE-2026-71550 9.9 CRITICAL SuiteCRM: LFI to RCE via AOW_WorkFlow
CVE-2026-100358 9.4 CRITICAL SuiteCRM: Admin OS RCE via Dropdown Editor PHP Injection
CVE-2026-69134 8.8 HIGH SuiteCRM: SQL Injection via REST API securexss() Bypass in Relationship Management
CVE-2026-69142 8.8 HIGH SuiteCRM: Authenticated SQL Injection in map_markers distance Parameter
CVE-2026-97377 8.8 HIGH SuiteCRM: Authenticated SQL Injection in SOAP Portal Method portal_get_entry_list
CVE-2026-71548 8.8 HIGH SuiteCRM: Authenticated SQL Injection in AOR_Reports `parameter_value` (value_type=Field)
CVE-2026-100365 8.8 HIGH SuiteCRM: Time-Based Blind SQL Injection via AOR_Reports ORDER BY Clause Allows Data Exfil
CVE-2026-100363 8.8 HIGH SuiteCRM: Privilege escalation via V8 REST modules (ACLRoles, ACLActions, Administration)
CVE-2026-63214 8.8 HIGH SuiteCRM: Authenticated SQL Injection in v4_1 get_entry_list rest api
CVE-2026-63215 8.3 HIGH SuiteCRM: Time-Based Blind SQL Injection via REST API
CVE-2026-69141 8.3 HIGH SuiteCRM: SQL injection via search param in modules/Cases/controller.php
CVE-2026-61648 8.3 HIGH SuiteCRM: SQL injection via parameter_value[0] param in AOR_Report.php
CVE-2026-61651 8.3 HIGH SuiteCRM: Authenticated SQL Injection in get_end_date function in Project Controller
CVE-2026-61653 8.3 HIGH SuiteCRM: SQL injection via id param in modules/Campaigns/PopupCampaignRoi.php
CVE-2026-61650 8.1 HIGH SuiteCRM: Incorrect Access Control in V8 relationship creation via missing edit authorizat
CVE-2026-61649 7.7 HIGH SuiteCRM: isSelfRequest() bypass via substring match allows SSRF to internal services
CVE-2026-69137 7.7 HIGH SuiteCRM: Authenticated SSRF in CalendarAccount testConnection Allows Internal Network Acc
CVE-2026-63213 7.2 HIGH SuiteCRM: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') i
CVE-2026-100361 7.1 HIGH SuiteCRM: Mass Assignment in V8 API Allows Modification of Sensitive User Fields (user_has
CVE-2026-100360 7.1 HIGH SuiteCRM: V8 API Relationship Delete Bypasses Object-Level Authorization on the Related Re

Showing top 20 of 31 CVEs. View all on vendor page &rarr; →

IV. Related Vulnerabilities

Same product: SuiteCRM
Same vendor: SuiteCRM
Same weakness: CWE-89