What is the CVSS score of CVE-2026-29100?

CVE-2026-29100 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N. EPSS exploitation probability: 0.0%.

Which versions of Suitecrm are affected by CVE-2026-29100?

SuiteCRM 7.15.0 contains a reflected HTML injection vulnerability in the login page that enables attackers to conduct phishing attacks and deface the application interface.

How to fix or mitigate CVE-2026-29100?

Within 24 hours: Inventory all SuiteCRM 7.15.0 instances and assess exposure; notify affected users of phishing risks and reinforce security awareness. Within 7 days: Upgrade to SuiteCRM 7.15.1 if available in your environment, or implement WAF rules to filter HTML injection payloads on login endpoints. Within 30 days: Complete full deployment of patched versions across all instances; conduct security awareness training focused on phishing recognition; review login logs for suspicious activity.

Suitecrm CVE-2026-29100

HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-03-19 GitHub_M

XSS Suitecrm

7.1

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

7.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Mar 19, 2026 - 23:00 vuln.today

CVE Published

Mar 19, 2026 - 22:48 nvd

HIGH 7.1

DescriptionGitHub Advisory

SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. SuiteCRM 7.15.0 contains a reflected HTML injection vulnerability in the login page that allows attackers to inject arbitrary HTML content, enabling phishing attacks and page defacement. Version 7.15.1 patches the issue.

AnalysisAI

A reflected HTML injection vulnerability exists in the login page of SuiteCRM 7.15.0, allowing attackers to inject arbitrary HTML content that can be used for phishing attacks and page defacement. The vulnerability requires user interaction (clicking a malicious link) but needs no authentication, affecting this specific version of the open-source CRM platform. While no active exploitation has been reported in KEV and no public POC is mentioned, the vulnerability presents a moderate risk for targeted phishing campaigns.

Technical ContextAI

SuiteCRM is an open-source enterprise CRM application built on PHP, and this vulnerability affects version 7.15.0 as identified by CPE cpe:2.3:a:suitecrm:suitecrm:*:*:*:*:*:*:*:*. The flaw is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation), which occurs when user-supplied data is not properly sanitized before being included in HTML output, allowing malicious HTML/JavaScript to be reflected back to users. The vulnerability specifically manifests in the login page, a critical entry point that all users must interact with.

RemediationAI

Upgrade SuiteCRM to version 7.15.1 or later, which contains the patch for this vulnerability as confirmed in the GitHub advisory at https://github.com/SuiteCRM/SuiteCRM/security/advisories/GHSA-g7hf-3j93-rwm5. Until patching is possible, implement input validation on the login page parameters, deploy a web application firewall (WAF) to filter malicious HTML injection attempts, and educate users about phishing risks and suspicious login page URLs. Consider implementing Content Security Policy (CSP) headers to mitigate the impact of successful HTML injection attacks.