Suitecrm vulnerabilities

CVEs per yearBy the year they were published

1. 202515
2. 202653

Newest CVEs

• CVE-2026-100358

  SuiteCRM: Admin OS RCE via Dropdown Editor PHP Injection

  SuiteCRM · SuiteCRM

  Critical9.4
• CVE-2026-100363

  SuiteCRM: Privilege escalation via V8 REST modules (ACLRoles, ACLActions, Administration)

  SuiteCRM · SuiteCRM

  High8.8
• CVE-2026-100359

  SuiteCRM: Authenticated SQL Injection In action_get_end_date function

  SuiteCRM · SuiteCRM

  Medium6.5
• CVE-2026-100362

  SuiteCRM: V8 OAuth2 Username Enumeration

  SuiteCRM · SuiteCRM

  Medium6.9
• CVE-2026-97377

  SuiteCRM: Authenticated SQL Injection in SOAP Portal Method portal_get_entry_list

  SuiteCRM · SuiteCRM

  High8.8
• CVE-2026-100360

  SuiteCRM: V8 API Relationship Delete Bypasses Object-Level Authorization on the Related Record

  SuiteCRM · SuiteCRM

  High7.1
• CVE-2026-100361

  SuiteCRM: Mass Assignment in V8 API Allows Modification of Sensitive User Fields (user_hash, external_auth_only)

  SuiteCRM · SuiteCRM

  High7.1
• CVE-2026-100364

  SuiteCRM V8 JSON:API processAttributes() Missing ID Filter Allows ACL Bypass and Record Ownership Hijack

  SuiteCRM · SuiteCRM

  High7.1
• CVE-2026-100365

  SuiteCRM: Time-Based Blind SQL Injection via AOR_Reports ORDER BY Clause Allows Data Exfiltration by Any Authenticated User

  SuiteCRM · SuiteCRM

  High8.8
• CVE-2026-71548

  SuiteCRM: Authenticated SQL Injection in AOR_Reports `parameter_value` (value_type=Field) allows any low-privileged user to read the full database

  SuiteCRM · SuiteCRM

  High8.8