SugarCRM vulnerabilities
We track 8 vulnerabilities in SugarCRM products. 8 are rated high or critical, and 1 has been exploited in real attacks. The most recent was published on June 20, 2025.
Latest SugarCRM vulnerabilities
- 9.3 Critical severity
SugarCRM: Deserialization of Untrusted Data
A PHP object injection vulnerability exists in SugarCRM versions prior to 6.5.24, 6.7.13, 7.5.2.5, 7.6.2.2, and 7.7.1.0 due to improper validation of PHP serialized input in the SugarRestSerialize.php script. The vulnerable code fails to sanitize the rest_data
- 8.8 High severity
sugarcrm: Improper Control of Generation of Code
An issue was discovered in SugarCRM 12 before 12.0.4 and 13 before 13.0.2. A Server Site Template Injection (SSTI) vulnerability has been identified in the GecControl action. By using a crafted request, custom PHP code can be injected via the GetControl action
- 8.8 High severity
sugarcrm: Unrestricted Upload of File with Dangerous Type
An issue was discovered in SugarCRM 12 before 12.0.4 and 13 before 13.0.2. An Unrestricted File Upload vulnerability has been identified in the Notes module. By using a crafted request, custom PHP code can be injected via the Notes module because of missing in
- 8.8 High severity
Sugarcrm: Improper Neutralization of Special Elements used in an SQL Command
An issue was discovered in SugarCRM Enterprise before 11.0.6 and 12.x before 12.0.3. Two SQL Injection vectors have been identified in the REST API. By using crafted requests, custom SQL code can be injected through the REST API because of missing input valida
- 7.2 High severity
Sugarcrm: Improper Neutralization of Special Elements in Output Used by a Downstream Component
An issue was discovered in SugarCRM Enterprise before 11.0.6 and 12.x before 12.0.3. A Second-Order PHP Object Injection vulnerability has been identified in the DocuSign module. By using crafted requests, custom PHP code can be injected and executed through t
- 8.8 High severity
Sugarcrm: Improper Control of Generation of Code
An issue was discovered in SugarCRM Enterprise before 11.0.6 and 12.x before 12.0.3. A Bean Manipulation vulnerability has been identified in the REST API. By using a crafted request, custom PHP code can be injected through the REST API because of missing inpu
- 8.8 High severity
Sugarcrm: Unrestricted Upload of File with Dangerous Type
An issue was discovered in SugarCRM Enterprise before 11.0.6 and 12.x before 12.0.3. An Unrestricted File Upload vulnerability has been identified in the Notes module. By using crafted requests, custom PHP code can be injected and executed through the Notes mo
- 8.8 High severity
Multiple SugarCRM Products Remote Code Execution Exploited
In SugarCRM before 12.0. Hotfix 91155, a crafted request can inject custom PHP code through the EmailTemplates because of missing input validation.