Skip to content
Noroxi

SugarCRM records

68 published records for vendor sugarcrm.

Researcher profile

Entered KEV
1 · 1.5%
Weaponized
2 · 2.9%
Pre-auth RCE
8
With a fix record
0%
Median publish → KEV
22 days

Records by year

  1. 17
  2. 18
  3. 19
  4. 20
  5. 21
  6. 23

Bar: total · dark part: CISA KEV.

Recurring classes

The weakness classes this vendor ships most often: where to look.

CWE

Attack profile

All records

68 records
  • CVE-2023-22952
    89Now

    In SugarCRM before 12.0.

    HighCVSS 8.8KEVWeaponizedEPSS 80%

    sugarcrm · sugarcrmJan 11, 2023

  • CVE-2012-0694
    60This week

    SugarCRM CE <= 6.3.1 contains scripts that use "unserialize()" with user controlled input which allows remote attackers to execute arbitrary

    CriticalCVSS 9.8WeaponizedEPSS 67%

    sugarcrm · sugarcrmOct 29, 2019

  • CVE-2014-3244
    41Plan

    XML external entity (XXE) vulnerability in the RSSDashlet dashlet in SugarCRM before 6.5.17 allows remote attackers to read arbitrary files

    CriticalCVSS 9.8No exploitEPSS 5%

    sugarcrm · sugarcrmFeb 1, 2018

  • CVE-2004-1227
    41Plan

    Directory traversal vulnerability in SugarCRM Sugar Sales 2.0.1c and earlier allows remote attackers to read arbitrary files and possibly ex

    CriticalCVSS 10.0Proof of conceptEPSS 4%

    sugarcrm · sugar salesJan 10, 2005

  • CVE-2004-1225
    41Plan

    SQL injection vulnerability in SugarCRM Sugar Sales before 2.0.1a allows remote attackers to execute arbitrary SQL commands and gain privile

    CriticalCVSS 10.0Proof of conceptEPSS 1%

    sugarcrm · sugarcrmJan 10, 2005

  • CVE-2020-7472
    40Plan

    An authorization bypass and PHP local-file-include vulnerability in the installation component of SugarCRM before 8.0, 8.0 before 8.0.7, 9.0

    CriticalCVSS 9.8No exploitEPSS 3%

    sugarcrm · sugarcrmNov 12, 2020

  • CVE-2018-6308
    39Monitor

    Multiple SQL injections exist in SugarCRM Community Edition 6.5.26 and below via the track parameter to modules\Campaigns\Tracker.php and mo

    CriticalCVSS 9.8No exploitEPSS 1%

    sugarcrm · sugarcrmJan 25, 2018

  • CVE-2017-14509
    37Monitor

    An issue was discovered in SugarCRM before 7.7.2.3, 7.8.x before 7.8.2.2, and 7.9.x before 7.9.2.0 (and Sugar Community Edition 6.5.26).

    HighCVSS 8.8No exploitEPSS 5%

    sugarcrm · sugarcrmSep 17, 2017

  • CVE-2017-14508
    36Monitor

    An issue was discovered in SugarCRM before 7.7.2.3, 7.8.x before 7.8.2.2, and 7.9.x before 7.9.2.0 (and Sugar Community Edition 6.5.26).

    HighCVSS 8.8No exploitEPSS 2%

    sugarcrm · sugarcrmSep 17, 2017

  • CVE-2019-17311
    36Monitor

    SugarCRM before 8.0.4 and 9.x before 9.0.2 allows directory traversal in the attachment function by a Regular user.

    HighCVSS 8.8No exploitEPSS 1%

    sugarcrm · sugarcrmOct 7, 2019

  • CVE-2019-17312
    36Monitor

    SugarCRM before 8.0.4 and 9.x before 9.0.2 allows directory traversal in the file function by a Regular user.

    HighCVSS 8.8No exploitEPSS 1%

    sugarcrm · sugarcrmOct 7, 2019

  • CVE-2019-17313
    36Monitor

    SugarCRM before 8.0.4 and 9.x before 9.0.2 allows directory traversal in the Studio module by a Developer user.

    HighCVSS 8.8No exploitEPSS 1%

    sugarcrm · sugarcrmOct 7, 2019

  • CVE-2019-17316
    35Monitor

    SugarCRM before 8.0.4 and 9.x before 9.0.2 allows PHP object injection in the Import module by a Regular user.

    HighCVSS 8.8No exploitEPSS 1%

    sugarcrm · sugarcrmOct 7, 2019

  • CVE-2019-17303
    35Monitor

    SugarCRM before 8.0.4 and 9.x before 9.0.2 allows PHP code injection in the MergeRecords module by a Developer user.

    HighCVSS 8.8No exploitEPSS 1%

    sugarcrm · sugarcrmOct 7, 2019

  • CVE-2019-17308
    35Monitor

    SugarCRM before 8.0.4 and 9.x before 9.0.2 allows PHP code injection in the Emails module by a Regular user.

    HighCVSS 8.8No exploitEPSS 1%

    sugarcrm · sugarcrmOct 7, 2019

  • CVE-2019-17305
    35Monitor

    SugarCRM before 8.0.4 and 9.x before 9.0.2 allows PHP code injection in the MergeRecords module by a Regular user.

    HighCVSS 8.8No exploitEPSS 1%

    sugarcrm · sugarcrmOct 7, 2019

  • CVE-2019-17300
    35Monitor

    SugarCRM before 8.0.4 and 9.x before 9.0.2 allows PHP code injection in the Administration module by a Developer user.

    HighCVSS 8.8No exploitEPSS 1%

    sugarcrm · sugarcrmOct 7, 2019

  • CVE-2019-17302
    35Monitor

    SugarCRM before 8.0.4 and 9.x before 9.0.2 allows PHP code injection in the ModuleBuilder module by a Developer user.

    HighCVSS 8.8No exploitEPSS 1%

    sugarcrm · sugarcrmOct 7, 2019

  • CVE-2023-35809
    35Monitor

    An issue was discovered in SugarCRM Enterprise before 11.0.6 and 12.x before 12.0.3.

    HighCVSS 8.8No exploitEPSS 1%

    sugarcrm · sugarcrmJun 17, 2023

  • CVE-2023-35808
    35Monitor

    An issue was discovered in SugarCRM Enterprise before 11.0.6 and 12.x before 12.0.3.

    HighCVSS 8.8No exploitEPSS 1%

    sugarcrm · sugarcrmJun 17, 2023

  • CVE-2019-17319
    35Monitor

    SugarCRM before 8.0.4 and 9.x before 9.0.2 allows SQL injection in the Emails module by a Regular user.

    HighCVSS 8.8No exploitEPSS 1%

    sugarcrm · sugarcrmOct 7, 2019

  • CVE-2019-17318
    35Monitor

    SugarCRM before 8.0.4 and 9.x before 9.0.2 allows SQL injection in the pmse_Inbox module by a Regular user.

    HighCVSS 8.8No exploitEPSS 1%

    sugarcrm · sugarcrmOct 7, 2019

  • CVE-2019-17295
    35Monitor

    SugarCRM before 8.0.4 and 9.x before 9.0.2 allows SQL injection in the history function by a Regular user.

    HighCVSS 8.8No exploitEPSS 1%

    sugarcrm · sugarcrmOct 7, 2019

  • CVE-2019-17298
    35Monitor

    SugarCRM before 8.0.4 and 9.x before 9.0.2 allows SQL injection in the Administration module by a Developer user.

    HighCVSS 8.8No exploitEPSS 1%

    sugarcrm · sugarcrmOct 7, 2019

  • CVE-2019-17293
    35Monitor

    SugarCRM before 8.0.4 and 9.x before 9.0.2 allows SQL injection in the pmse_Project module by a Regular user.

    HighCVSS 8.8No exploitEPSS 1%

    sugarcrm · sugarcrmOct 7, 2019