Zafiyet.live Keşfet. Değerlendir. Düzelt. Doğrula.
Menü

SuiteCRM güvenlik açıkları

SuiteCRM

SuiteCRM için bildirim al RSS

Toplam açık
31
Kritik
2
Aktif istismar
0
Yaması çıkan
31
Son açık
2 sa önce
Önem dağılımı
  • Kritik 2
  • Yüksek 23
  • Orta 6
  • Düşük 0

Son açıklar

31 açık

  1. 9,4Kritik CVE-2026-100358Yama var SuiteCRM: Admin OS RCE via Dropdown Editor PHP Injection SuiteCRMCWE-942 sa önce
  2. 8,8Yüksek CVE-2026-100363Yama var SuiteCRM: Privilege escalation via V8 REST modules (ACLRoles, ACLActions, Administration) SuiteCRMCWE-2692 sa önce
  3. 6,5Orta CVE-2026-100359Yama var SuiteCRM: Authenticated SQL Injection In action_get_end_date function SuiteCRMCWE-892 sa önce
  4. 6,9Orta CVE-2026-100362Yama var SuiteCRM: V8 OAuth2 Username Enumeration SuiteCRMCWE-2042 sa önce
  5. 8,8Yüksek CVE-2026-97377Yama var SuiteCRM: Authenticated SQL Injection in SOAP Portal Method portal_get_entry_list SuiteCRMCWE-892 sa önce
  6. 7,1Yüksek CVE-2026-100360Yama var SuiteCRM: V8 API Relationship Delete Bypasses Object-Level Authorization on the Related Record SuiteCRMCWE-8622 sa önce
  7. 7,1Yüksek CVE-2026-100361Yama var SuiteCRM: Mass Assignment in V8 API Allows Modification of Sensitive User Fields (user_hash, external_auth_only) SuiteCRMCWE-9152 sa önce
  8. 7,1Yüksek CVE-2026-100364Yama var SuiteCRM V8 JSON:API processAttributes() Missing ID Filter Allows ACL Bypass and Record Ownership Hijack SuiteCRMCWE-6392 sa önce
  9. 8,8Yüksek CVE-2026-100365Yama var SuiteCRM: Time-Based Blind SQL Injection via AOR_Reports ORDER BY Clause Allows Data Exfiltration by Any Authenticated User SuiteCRMCWE-892 sa önce
  10. 8,8Yüksek CVE-2026-71548Yama var SuiteCRM: Authenticated SQL Injection in AOR_Reports `parameter_value` (value_type=Field) allows any low-privileged user to read the full database SuiteCRMCWE-202 sa önce
  11. 9,9Kritik CVE-2026-71550Yama var SuiteCRM: LFI to RCE via AOW_WorkFlow SuiteCRMCWE-982 sa önce
  12. 8,8Yüksek CVE-2026-69134Yama var SuiteCRM: SQL Injection via REST API securexss() Bypass in Relationship Management SuiteCRMCWE-892 sa önce
  13. 8,3Yüksek CVE-2026-69141Yama var SuiteCRM: SQL injection via search param in modules/Cases/controller.php SuiteCRMCWE-892 sa önce
  14. 8,8Yüksek CVE-2026-69142Yama var SuiteCRM: Authenticated SQL Injection in map_markers distance Parameter SuiteCRMCWE-892 sa önce
  15. 8,3Yüksek CVE-2026-69140Yama var SuiteCRM: SQL injection via get_latest_for_id param in GetLatestRevision.php SuiteCRMCWE-892 sa önce
  16. 6,5Orta CVE-2026-69145Yama var SuiteCRM: AOR Reports aor_fields.field SQL Injection SuiteCRMCWE-892 sa önce
  17. 7,1Yüksek CVE-2026-69136Yama var SuiteCRM: Authenticated SQL Injection In handleAttachments function SuiteCRMCWE-892 sa önce
  18. 7,1Yüksek CVE-2026-69135Yama var SuiteCRM: Authenticated SQL Injection In Project Module SuiteCRMCWE-892 sa önce
  19. 6,5Orta CVE-2026-69144Yama var SuiteCRM: Authorization Bypass via Document Revision ID Confusion in download.php SuiteCRMCWE-6392 sa önce
  20. 7,7Yüksek CVE-2026-69137Yama var SuiteCRM: Authenticated SSRF in CalendarAccount testConnection Allows Internal Network Access and Response Disclosure SuiteCRMCWE-9182 sa önce
  21. 8,3Yüksek CVE-2026-61648Yama var SuiteCRM: SQL injection via parameter_value[0] param in AOR_Report.php SuiteCRMCWE-892 sa önce
  22. 8,1Yüksek CVE-2026-61650Yama var SuiteCRM: Incorrect Access Control in V8 relationship creation via missing edit authorization SuiteCRMCWE-8622 sa önce
  23. 8,3Yüksek CVE-2026-61653Yama var SuiteCRM: SQL injection via id param in modules/Campaigns/PopupCampaignRoi.php SuiteCRMCWE-892 sa önce
  24. 7,2Yüksek CVE-2026-63213Yama var SuiteCRM: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in SuiteCRM SuiteCRMCWE-222 sa önce
  25. 7,7Yüksek CVE-2026-61649Yama var SuiteCRM: isSelfRequest() bypass via substring match allows SSRF to internal services SuiteCRMCWE-9183 sa önce