CVE-2026-61653High· 8.3▾ TwilightSuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to 7.15.2 and 8.10.2, modules/Campaigns/PopupCampaignRoi.php interpolates $_REQUEST['id'] into SQL. Although securexss() norm…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 45.7 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to 7.15.2 and 8.10.2, modules/Campaigns/PopupCampaignRoi.php interpolates $_REQUEST['id'] into SQL. Although securexss() normally entity-encodes quotes, an input prefixed with an XSS payload makes AntiXSS select a processed string instead of the entity-encoded backup, allowing a literal quote to reach the query. An authenticated user with Campaigns access can perform time-based blind SQL injection against arbitrary database tables. This issue is fixed in versions 7.15.2 and 8.10.2.
SuiteCRM < 7.15.2SuiteCRM >= 8.0.0, < 8.10.2Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-97377High· 8.8SuiteCRM: Authenticated SQL Injection in SOAP Portal Method portal_get_entry_list
CVE-2026-69141High· 8.3SuiteCRM: SQL injection via search param in modules/Cases/controller.php
CVE-2026-69135High· 7.1SuiteCRM: Authenticated SQL Injection In Project Module
CVE-2026-100365High· 8.8SuiteCRM: Time-Based Blind SQL Injection via AOR_Reports ORDER BY Clause Allows Data Exfiltration by Any Authenticated User
CVE-2026-100359Medium· 6.5SuiteCRM: Authenticated SQL Injection In action_get_end_date function
CVE-2026-69140High· 8.3SuiteCRM: SQL injection via get_latest_for_id param in GetLatestRevision.php