95
CVEs
19
Critical
41
High
0
KEV
33
PoC
47
Unpatched C/H
25.3%
Patch Rate
3.3%
Avg EPSS
Severity Breakdown
CRITICAL
19
HIGH
41
MEDIUM
34
LOW
1
Monthly CVE Trend
Affected Products (3)
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2020-28328 | SuiteCRM before 7.11.17 is vulnerable to remote code execution via the system settings Log File Name setting. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available. | HIGH | 8.8 | 63.3% | 79 |
PoC
No patch
|
| CVE-2021-42840 | SuiteCRM before 7.11.19 allows remote code execution via the system settings Log File Name setting. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available. | HIGH | 8.8 | 58.9% | 79 |
PoC
No patch
|
| CVE-2023-6126 | Code Injection in GitHub repository salesagility/suitecrm prior to 7.14.2, 7.12.14, 8.4.2. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available. | CRITICAL | 9.8 | 0.7% | 69 |
PoC
|
| CVE-2024-36412 | SuiteCRM is an open-source Customer Relationship Management (CRM) software application. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available. | CRITICAL | 9.8 | 5.7% | 69 |
PoC
No patch
|
| CVE-2023-5350 | SQL Injection in GitHub repository salesagility/suitecrm prior to 7.14.1. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available. | CRITICAL | 9.1 | 1.9% | 66 |
PoC
|
| CVE-2015-5947 | SuiteCRM before 7.2.3 allows remote attackers to execute arbitrary code. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, no authentication required. Public exploit code available and no vendor patch available. | HIGH | 8.1 | 4.8% | 65 |
PoC
No patch
|
| CVE-2022-45185 | An issue was discovered in SuiteCRM 7.12.7. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available. | HIGH | 8.8 | 0.3% | 64 |
PoC
No patch
|
| CVE-2021-45041 | SuiteCRM before 7.12.2 and 8.x before 8.0.1 allows authenticated SQL injection via the Tooltips action in the Project module, involving resource_id and start_date. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available. | HIGH | 8.8 | 2.2% | 64 |
PoC
|
| CVE-2022-23940 | SuiteCRM through 7.12.1 and 8.x through 8.0.1 allows Remote Code Execution. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available. | HIGH | 8.8 | 53.2% | 64 |
PoC
No patch
|
| CVE-2023-1034 | Path Traversal: '\..\filename' in GitHub repository salesagility/suitecrm prior to 7.12.9. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available. | HIGH | 8.8 | 28.1% | 64 |
PoC
|
| CVE-2023-3627 | Cross-Site Request Forgery (CSRF) in GitHub repository salesagility/suitecrm-core prior to 8.3.1. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available. | HIGH | 8.8 | 0.4% | 64 |
PoC
|
| CVE-2023-6125 | Code Injection in GitHub repository salesagility/suitecrm prior to 7.14.2, 7.12.14, 8.4.2. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available. | HIGH | 8.8 | 0.8% | 64 |
PoC
|
| CVE-2023-6130 | Path Traversal: '\..\filename' in GitHub repository salesagility/suitecrm prior to 7.14.2, 7.12.14, 8.4.2. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available. | HIGH | 8.8 | 1.0% | 64 |
PoC
|
| CVE-2023-6131 | Code Injection in GitHub repository salesagility/suitecrm prior to 7.14.2, 7.12.14, 8.4.2. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available. | HIGH | 8.8 | 1.0% | 64 |
PoC
|
| CVE-2024-1644 | Suite CRM version 7.14.2 allows including local php files. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available. | HIGH | 8.8 | 0.9% | 64 |
PoC
No patch
|