Salesagility Suitecrm vulnerabilities

CVE-2024-36419 [MEDIUM] CWE-601 CVE-2024-36419: SuiteCRM is an open-source Customer Relationship Management (CRM) software application. A vulnerabil SuiteCRM is an open-source Customer Relationship Management (CRM) software application. A vulnerability in versions prior to 8.6.1 allows for Host Header Injection when directly accessing the `/legacy` route. Version 8.6.1 contains a patch for the issue.

CVE-2019-16922 [MEDIUM] CVE-2019-16922: SuiteCRM 7.10.x before 7.10.20 and 7.11.x before 7.11.8 allows unintended public exposure of files. SuiteCRM 7.10.x before 7.10.20 and 7.11.x before 7.11.8 allows unintended public exposure of files.

CVE-2023-6127 [MEDIUM] CWE-434 CVE-2023-6127: Unrestricted Upload of File with Dangerous Type in GitHub repository salesagility/suitecrm prior to Unrestricted Upload of File with Dangerous Type in GitHub repository salesagility/suitecrm prior to 7.14.2, 7.12.14, 8.4.2.

CVE-2021-39268 [MEDIUM] CWE-79 CVE-2021-39268: Persistent cross-site scripting (XSS) in the web interface of SuiteCRM before 7.11.19 allows a remot Persistent cross-site scripting (XSS) in the web interface of SuiteCRM before 7.11.19 allows a remote attacker to introduce arbitrary JavaScript via malicious SVG files. This occurs because the clean_file_output protection mechanism can be bypassed.

CVE-2021-45903 [MEDIUM] CVE-2021-45903: A persistent cross-site scripting (XSS) issue in the web interface of SuiteCRM before 7.10.35, and 7 A persistent cross-site scripting (XSS) issue in the web interface of SuiteCRM before 7.10.35, and 7.11.x and 7.12.x before 7.12.2, allows a remote attacker to introduce arbitrary JavaScript via attachments upload, a different vulnerability than CVE-2021-39267 and CVE-2021-39268.

CVE-2025-54783 [MEDIUM] CWE-79 CVE-2025-54783: SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software applica SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Versions 7.14.6 and below have a Reflected Cross-Site Scripting (XSS) vulnerability. This vulnerability allows an attacker to execute JavaScript code by modifying the HTTP Referer header to include some arbitrary domain with malicious JavaScript

CVE-2025-41384 [MEDIUM] CWE-79 CVE-2025-41384: Cross-Site Scripting (XSS) vulnerability reflected in SuiteCRM v7.14.1. This vulnerability allows an Cross-Site Scripting (XSS) vulnerability reflected in SuiteCRM v7.14.1. This vulnerability allows an attacker to execute JavaScript code by modifying the HTTP Referer header to include an arbitrary domain with malicious JavaScript code at the end. The server will attempt to block the arbitrary domain but will allow the JavaScript code to execute.

CVE-2025-64491 [MEDIUM] CWE-79 CVE-2025-64491: SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software applica SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Versions 7.14.7 and below allow unauthenticated reflected Cross-Site Scripting (XSS). Successful exploitation could lead to full account takeover, for example by altering the login form to send credentials to an attacker-controlled server. As a r

CVE-2024-50335 [MEDIUM] CWE-79 CVE-2024-50335: SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software applica SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. The "Publish Key" field in SuiteCRM's Edit Profile page is vulnerable to Reflected Cross-Site Scripting (XSS), allowing an attacker to inject malicious JavaScript code. This can be exploited to steal CSRF tokens and perform unauthorized actions,

CVE-2018-20816 [MEDIUM] CWE-79 CVE-2018-20816: An XSS combined with CSRF vulnerability discovered in SalesAgility SuiteCRM 7.x before 7.8.24 and 7. An XSS combined with CSRF vulnerability discovered in SalesAgility SuiteCRM 7.x before 7.8.24 and 7.10.x before 7.10.11 leads to cookie stealing, aka session hijacking. This issue affects the "add dashboard pages" feature where users can receive a malicious attack through a phished URL, with script executed.

CVE-2021-31792 [MEDIUM] CWE-79 CVE-2021-31792: XSS in the client account page in SuiteCRM before 7.11.19 allows an attacker to inject JavaScript vi XSS in the client account page in SuiteCRM before 7.11.19 allows an attacker to inject JavaScript via the name field

CVE-2019-18782 [MEDIUM] CVE-2019-18782: SuiteCRM 7.10.x prior to 7.10.21 and 7.11.x prior to 7.11.9 does not correctly implement the .htacce SuiteCRM 7.10.x prior to 7.10.21 and 7.11.x prior to 7.11.9 does not correctly implement the .htaccess protection mechanism.

CVE-2019-14752 [MEDIUM] CWE-79 CVE-2019-14752: SuiteCRM 7.10.x and 7.11.x before 7.10.20 and 7.11.8 has XSS. SuiteCRM 7.10.x and 7.11.x before 7.10.20 and 7.11.8 has XSS.

CVE-2020-14208 [MEDIUM] CWE-79 CVE-2020-14208: SuiteCRM 7.11.13 is affected by stored Cross-Site Scripting (XSS) in the Documents preview functiona SuiteCRM 7.11.13 is affected by stored Cross-Site Scripting (XSS) in the Documents preview functionality. This vulnerability could allow remote authenticated attackers to inject arbitrary web script or HTML.

CVE-2023-6128 [MEDIUM] CWE-79 CVE-2023-6128: Cross-site Scripting (XSS) - Reflected in GitHub repository salesagility/suitecrm prior to 7.14.2, 7 Cross-site Scripting (XSS) - Reflected in GitHub repository salesagility/suitecrm prior to 7.14.2, 7.12.14, 8.4.2.

CVE-2023-5351 [MEDIUM] CWE-79 CVE-2023-5351: Cross-site Scripting (XSS) - Stored in GitHub repository salesagility/suitecrm prior to 7.14.1. Cross-site Scripting (XSS) - Stored in GitHub repository salesagility/suitecrm prior to 7.14.1.

CVE-2024-36413 [MEDIUM] CWE-79 CVE-2024-36413: SuiteCRM is an open-source Customer Relationship Management (CRM) software application. Prior to ver SuiteCRM is an open-source Customer Relationship Management (CRM) software application. Prior to versions 7.14.4 and 8.6.1, a vulnerability in the import module error view allows for a cross-site scripting attack. Versions 7.14.4 and 8.6.1 contain a fix for this issue.

CVE-2024-36406 [MEDIUM] CWE-601 CVE-2024-36406: SuiteCRM is an open-source Customer Relationship Management (CRM) software application. In versions SuiteCRM is an open-source Customer Relationship Management (CRM) software application. In versions prior to 7.14.4 and 8.6.1, unchecked input allows for open re-direct. Versions 7.14.4 and 8.6.1 contain a fix for this issue.

CVE-2020-15300 [MEDIUM] CWE-601 CVE-2020-15300: SuiteCRM through 7.11.13 has an Open Redirect in the Documents module via a crafted SVG document. SuiteCRM through 7.11.13 has an Open Redirect in the Documents module via a crafted SVG document.

CVE-2018-15606 [MEDIUM] CWE-79 CVE-2018-15606: An XSS issue was discovered in SalesAgility SuiteCRM 7.x before 7.8.21 and 7.10.x before 7.10.8, rel An XSS issue was discovered in SalesAgility SuiteCRM 7.x before 7.8.21 and 7.10.x before 7.10.8, related to phishing an error message.