Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

SuiteCRM — Vulnerabilities & Security Advisories 51

All 51 CVE vulnerabilities found in SuiteCRM, with AI-generated Chinese analysis, references, and POCs.

This page aggregates historical security vulnerabilities specifically affecting the SuiteCRM open-source customer relationship management suite, organized by Common Weakness Enumeration tags. It collects documented flaws, including but not limited to cross-site scripting, SQL injection, and access control defects, covering the time range from the product’s initial public release through its current maintenance status. Readers can track the vendor's advisory history, analyze the frequency and severity of specific weakness classes, and review the complete vulnerability timeline for this product. The entries are sourced from public security bulletins and national vulnerability databases, providing a structured view of how SuiteCRM's security posture has evolved. By grouping issues under their respective CWE categories, this aggregation helps security teams identify recurring problem areas and assess the residual risk associated with the platform. The data supports both retrospective audits and forward-looking patch planning.

Vendor: salesagility

CVE ID Title CVSS Severity Published
CVE-2019-25664 SuiteCRM 7.10.7 SQL Injection via record Parameter CWE-89 7.1 High 2026-04-05
CVE-2019-25663 SuiteCRM 7.10.7 SQL Injection via parentTab Parameter CWE-89 7.1 High 2026-04-05
CVE-2026-33289 SuiterCRM has LDAP Filter Injection in Authentication Module CWE-90 8.8 High 2026-03-19
CVE-2026-33288 SuiteCRM has Authenticated SQL Injection in Authentication Module CWE-89 8.8 High 2026-03-19
CVE-2026-29189 SuiteCRM has a REST API V8 IDOR: Missing ACL Checks on User Preferences and Relationship Endpoints CWE-639 8.1 High 2026-03-19
CVE-2026-29107 SuiteCRM vulnerable to authenticated SSRF via PDF export CWE-918 5.0 Medium 2026-03-19
CVE-2026-29106 SuiteCRM has blind XSS in return_id parameter CWE-79 5.9 Medium 2026-03-19
CVE-2026-29105 SuiteCRM has Unauthenticated Open Redirect in Leads WebToLead Capture CWE-601 5.4 Medium 2026-03-19
CVE-2026-29104 SuiteCRM Vulnerable to Authenticated Arbitrary File Upload via Configurator addfontresult View in SuiteCRM CWE-434 2.7 Low 2026-03-19
CVE-2026-29103 SuiteCRM Vulnerable to Remote Code Execution via Module Loader Package Scanner Bypass CWE-94 9.1 Critical 2026-03-19
CVE-2026-29102 SuiteCRM has Authenticated RCE in Modules CWE-94 7.2 High 2026-03-19
CVE-2026-29101 SuiteCRM Vulnerable to Directory Traversal to DoS in Modules CWE-23 4.9 Medium 2026-03-19
CVE-2026-29100 SuiteCRM has Reflected HTML Injection in Login Page via default_user_name Parameter CWE-79 7.1 High 2026-03-19
CVE-2026-29099 SuiteCRM has Authenticated Blind SQL Injection in OutboundEmail Legacy Functionality. CWE-89 8.8 High 2026-03-19
CVE-2026-29098 SuiteCRM has Relative Path Traversal via ModuleBuilder Modules ExportCustom Action CWE-23 4.9 Medium 2026-03-19
CVE-2026-29097 SuiteCRM Server-Side Request Forgery and Denial of Service via RSS Feed Dashlet CWE-918 6.5 - 2026-03-19
CVE-2026-29096 SuiteCRM vulnerable to Authenticated SQL Injection via unsanitized field_function in Report Fields CWE-89 8.1 High 2026-03-19
CVE-2025-64491 SuiteCRM is vulnerable to unauthenticated reflected XSS through its Login page CWE-79 6.1 Medium 2025-11-08
CVE-2025-64490 SuiteCRM's Inconsistent RBAC Enforcement Enables Access Control Bypass CWE-863 8.3 High 2025-11-08
CVE-2025-64489 SuiteCRM: Privilege Escalation via Improper Session Invalidation and Inactive User Bypass CWE-269 8.3 High 2025-11-08
CVE-2025-64488 SuiteCRM: Authenticated SQL Injection Possible in Reschedule Call Module CWE-89 8.8 - 2025-11-07
CVE-2022-50590 SuiteCRM < 7.12.6 Type Confusion via 'deleteAttachment' Functionality CWE-843 7.5 - 2025-11-06
CVE-2022-50589 SuiteCRM < 7.12.6 SQL Injection via 'export' Functionality CWE-89 9.8 - 2025-11-06
CVE-2025-41384 Reflected Cross-Site Scripting (XSS) in SuiteCRM CWE-79 6.1AI Medium AI 2025-10-27
CVE-2025-54787 SuiteCRM: Improper Authorization for attachment downloads CWE-285 3.7 Low 2025-08-07
CVE-2025-54784 SuiteCRM is vulnerable to Cross Site Scripting (XSS) through its email viewer CWE-79 8.8AI High AI 2025-08-07
CVE-2025-54783 SuiteCRM: Reflected Cross Site Scripting (XSS) through HTTP Referrer header CWE-79 6.1AI Medium AI 2025-08-07
CVE-2025-54788 SuiteCRM: Authenticated Blind SQL Injection in InboundEmail module CWE-89 8.8 High 2025-08-06
CVE-2025-54785 SuiteCRM is Vulnerable to PHP Object Injection in Reports CWE-20 8.8 High 2025-08-06
CVE-2024-50335 Authenticated XSS in "Publish Key" Field Allowing Unauthorized Administrator User Creation in SuiteCRM CWE-79 4.9 Medium 2024-11-05

All 51 known CVE vulnerabilities affecting SuiteCRM with full Chinese analysis, references, and POCs where available.