CVE-2026-69142High· 8.8▾ TwilightSuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to 7.15.2 and 8.10.2, the jjwg_Maps map marker endpoint uses the authenticated caller's distance value in the map_markers act…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 48.4 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to 7.15.2 and 8.10.2, the jjwg_Maps map marker endpoint uses the authenticated caller's distance value in the map_markers action without strict numeric validation or parameterization. An authenticated attacker can alter the SQL query, extract database data, modify query results, and consume resources. This issue is fixed in versions 7.15.2 and 8.10.2.
SuiteCRM < 7.15.2SuiteCRM >= 8.0.0, < 8.10.2Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-97377High· 8.8SuiteCRM: Authenticated SQL Injection in SOAP Portal Method portal_get_entry_list
CVE-2026-69141High· 8.3SuiteCRM: SQL injection via search param in modules/Cases/controller.php
CVE-2026-69135High· 7.1SuiteCRM: Authenticated SQL Injection In Project Module
CVE-2026-100365High· 8.8SuiteCRM: Time-Based Blind SQL Injection via AOR_Reports ORDER BY Clause Allows Data Exfiltration by Any Authenticated User
CVE-2026-100359Medium· 6.5SuiteCRM: Authenticated SQL Injection In action_get_end_date function
CVE-2026-69140High· 8.3SuiteCRM: SQL injection via get_latest_for_id param in GetLatestRevision.php