Salesagility vulnerabilities
We track 16 vulnerabilities in Salesagility products. 16 are rated high or critical, and none are known to be exploited. The most recent was published on November 8, 2025.
Latest Salesagility vulnerabilities
- 8.8 High severity
SuiteCRM-Core: Improper Neutralization of Special Elements used in an SQL Command
SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Versions 8.9.0 and below contain a time-based blind SQL Injection vulnerability. This vulnerability allows an authenticated attacker to infer data from th
- 8.8 High severity
Suitecrm: Deserialization of Untrusted Data
An issue was discovered in SuiteCRM 7.12.7. Authenticated users can use CRM functions to upload malicious files. Then, deserialization can be used to achieve code execution.
- 8.8 High severity
SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software…
SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. User input is not validated and is written to the filesystem. The ParserLabel::addLabels() function can be used to write attacker-controlled data into the
- 8.8 High severity
SuiteCRM: Improper Neutralization of Special Elements used in an SQL Command
SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Insufficient input value validation causes Blind SQL injection in DeleteRelationShip. This issue has been addressed in versions 7.14.6 and 8.7.1. Users ar
- 7.2 High severity
SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software…
SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. SuiteCRM relies on the blacklist of functions/methods to prevent installation of malicious MLPs. But this checks can be bypassed with some syntax construc
- 8.8 High severity
SuiteCRM: Improper Neutralization of Special Elements used in an SQL Command
SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. In SuiteCRM versions 7.14.4, poor input validation allows authenticated user do a SQL injection attack. Authenticated user with low pivilege can leak all
- 8.8 High severity
SuiteCRM: Improper Limitation of a Pathname to a Restricted Directory
SuiteCRM is an open-source Customer Relationship Management (CRM) software application. Prior to versions 7.14.4 and 8.6.1, a vulnerability in connectors allows an authenticated user to perform a remote code execution attack. Versions 7.14.4 and 8.6.1 contain
- 9.0 Critical severity
SuiteCRM: Improper Neutralization of Input During Web Page Generation
SuiteCRM is an open-source Customer Relationship Management (CRM) software application. Prior to versions 7.14.4 and 8.6.1, an unverified IFrame can be added some some inputs, which could allow for a cross-site scripting attack. Versions 7.14.4 and 8.6.1 conta
- 7.5 High severity
SuiteCRM: Logging of Excessive Data
SuiteCRM is an open-source Customer Relationship Management (CRM) software application. Prior to versions 7.14.4 and 8.6.1, a deprecated v4 API example with no log rotation allows denial of service by logging excessive data. Versions 7.14.4 and 8.6.1 contain a
- 8.8 High severity
SuiteCRM: Unrestricted Upload of File with Dangerous Type
SuiteCRM is an open-source Customer Relationship Management (CRM) software application. Prior to versions 7.14.4 and 8.6.1, a vulnerability in uploaded file verification in products allows for remote code execution. Versions 7.14.4 and 8.6.1 contain a fix for
- 9.8 Critical severity
SuiteCRM: Improper Neutralization of Special Elements used in an SQL Command
SuiteCRM is an open-source Customer Relationship Management (CRM) software application. Prior to versions 7.14.4 and 8.6.1, a vulnerability in events response entry point allows for a SQL injection attack. Versions 7.14.4 and 8.6.1 contain a fix for this issue
- 8.8 High severity
SuiteCRM: Improper Neutralization of Special Elements used in an SQL Command
SuiteCRM is an open-source Customer Relationship Management (CRM) software application. In versions prior to 7.14.4 and 8.6.1, poor input validation allows for SQL Injection in EmailUIAjax displayView controller. Versions 7.14.4 and 8.6.1 contain a fix for thi
- 8.8 High severity
SuiteCRM: Improper Neutralization of Special Elements used in an SQL Command
SuiteCRM is an open-source Customer Relationship Management (CRM) software application. In versions prior to 7.14.4 and 8.6.1, poor input validation allows for SQL Injection in EmailUIAjax messages count controller. Versions 7.14.4 and 8.6.1 contain a fix for
- 8.8 High severity
SuiteCRM: Improper Neutralization of Special Elements used in an SQL Command
SuiteCRM is an open-source Customer Relationship Management (CRM) software application. In versions prior to 7.14.4 and 8.6.1, poor input validation allows for SQL Injection in Tree data entry point. Versions 7.14.4 and 8.6.1 contain a fix for this issue.
- 8.8 High severity
SuiteCRM: Improper Neutralization of Special Elements used in an SQL Command
SuiteCRM is an open-source Customer Relationship Management (CRM) software application. In versions prior to 7.14.4 and 8.6.1, poor input validation allows for SQL Injection in the `Alerts` controller. Versions 7.14.4 and 8.6.1 contain a fix for this issue.
- 8.8 High severity
Suitecrm: Deserialization of Untrusted Data
SuiteCRM through 7.12.1 and 8.x through 8.0.1 allows Remote Code Execution. Authenticated users with access to the Scheduled Reports module can achieve this by leveraging PHP deserialization in the email_recipients property. By using a crafted request, they ca