Suitecrm vulnerabilities

CVEs per yearBy the year they were published

1. 202515
2. 202622

Newest CVEs

• CVE-2026-108713

  SuiteCRM through 7.15.2 and 8.10.2 Missing Authorization via setCampaignMarketingAndTemplate

  SuiteCRM · SuiteCRM

  Medium5.3
• CVE-2026-108712

  SuiteCRM through 7.15.2 and 8.10.2 Missing Authorization via DetailUserRole Entry Point

  SuiteCRM · SuiteCRM

  Medium5.3
• CVE-2019-25664

  SuiteCRM 7.10.7 SQL Injection via record Parameter

  Suitecrm · SuiteCRM

  High7.1
• CVE-2019-25663

  SuiteCRM 7.10.7 SQL Injection via parentTab Parameter

  Suitecrm · SuiteCRM

  High7.1
• CVE-2026-32697

  SuiteCRM: RecordHandler::getRecord() missing ACLAccess('view') check allows any authenticated user to read any record (IDOR)

  SuiteCRM · SuiteCRM-Core

  Medium6.5
• CVE-2026-29109

  SuiteCRM Authenticated Remote Code Execution via Unsafe Deserialization in SavedSearch Filter Processing

  SuiteCRM · SuiteCRM-Core

  High8.6
• CVE-2026-29108

  Authenticated SuiteCRM Users Can Retrieve The Password Hash of Any User

  SuiteCRM · SuiteCRM-Core

  Medium6.5
• CVE-2026-33289

  SuiterCRM has LDAP Filter Injection in Authentication Module

  SuiteCRM · SuiteCRM

  High8.8
• CVE-2026-33288

  SuiteCRM has Authenticated SQL Injection in Authentication Module

  SuiteCRM · SuiteCRM

  High8.8
• CVE-2026-29189

  SuiteCRM has a REST API V8 IDOR: Missing ACL Checks on User Preferences and Relationship Endpoints

  SuiteCRM · SuiteCRM

  High8.1