Approved changes feed: RSS · Atom
cpe:2.3:a:sugarcrm:sugarcrm:*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | Sugarcrm (dd15fdac-9cd0-5ebf-98e7-767d21270f9e) |
|---|---|
| Product | Sugarcrm (153c5dce-2939-55e9-8424-89afa76b32da) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from purl2cpe mapping |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
pkg:github/sugarcrm/sugarcrm_dev |
purl2cpe | 2026-06-01 10:11:12.136188 |
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2025-25034 |
vulnerable | 2026-06-08 07:12:50.526259 |
SugarCRM PHP Deserialization RCE
A PHP object injection vulnerability exists in SugarCRM versions prior to 6.5.24, 6.7.13, 7.5.2.5, 7.6.2.2, and 7.7.1.0 due to improper validation of PHP serialized input in the SugarRestSerialize.php script. The vulnerable code fails to sanitize the rest_data parameter before passing it to the unserialize() function. This allows an unauthenticated attacker to submit crafted serialized data containing malicious object declarations, resulting in arbitrary code execution within the application context. Although SugarCRM released a prior fix in advisory sugarcrm-sa-2016-001, the patch was incomplete and failed to address some vectors. Exploitation evidence was observed by the Shadowserver Foundation on 2024-09-13 UTC.
Published: 2025-06-20T18:34:13.197Z
Updated: 2026-05-14T02:07:21.147Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-58258 |
vulnerable | 2026-06-08 06:56:14.298171 |
Details available
HIGH (7.2)
SugarCRM before 13.0.4 and 14.x before 14.0.1 allows SSRF in the API module because a limited type of code injection can occur.
Published: 2025-07-13T00:00:00.000Z
Updated: 2025-11-03T19:34:25.863Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-46816 |
vulnerable | 2026-06-08 06:14:23.472112 |
Details available
An issue was discovered in SugarCRM 12 before 12.0.4 and 13 before 13.0.2. A Server Site Template Injection (SSTI) vulnerability has been identified in the GecControl action. By using a crafted request, custom PHP code can be injected via the GetControl action because of missing input validation. An attacker with regular user privileges can exploit this.
Published: 2023-10-27T00:00:00.000Z
Updated: 2024-09-09T16:01:32.429Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-46815 |
vulnerable | 2026-06-08 06:14:23.462933 |
Details available
An issue was discovered in SugarCRM 12 before 12.0.4 and 13 before 13.0.2. An Unrestricted File Upload vulnerability has been identified in the Notes module. By using a crafted request, custom PHP code can be injected via the Notes module because of missing input validation. An attacker with regular user privileges can exploit this.
Published: 2023-10-27T00:00:00.000Z
Updated: 2024-09-09T16:04:44.024Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-22952 |
vulnerable | 2026-06-08 05:54:27.487965 |
Details available
In SugarCRM before 12.0. Hotfix 91155, a crafted request can inject custom PHP code through the EmailTemplates because of missing input validation.
Published: 2023-01-11T00:00:00.000Z
Updated: 2025-10-21T23:15:28.616Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2020-17373 |
vulnerable | 2026-06-08 05:20:56.352228 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2020-17372 |
vulnerable | 2026-06-08 05:20:56.351696 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2017-14510 |
vulnerable | 2026-06-08 05:08:50.071490 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2017-14509 |
vulnerable | 2026-06-08 05:08:50.070945 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2017-14508 |
vulnerable | 2026-06-08 05:08:50.065851 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2014-3244 |
vulnerable | 2026-06-08 05:05:31.937820 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2011-0745 |
vulnerable | 2026-06-08 04:56:39.456021 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2009-2978 |
vulnerable | 2026-06-08 04:51:31.626787 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2006-6712 |
vulnerable | 2026-06-08 04:49:29.547166 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2004-1226 |
vulnerable | 2026-06-08 04:47:53.380706 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.