CVE-2026-69145Medium· 6.5▾ SunlitSuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to 7.15.2 and 8.10.2, AOR report generation reloads the value stored in aor_fields.field and concatenates it into report SQL …
▾ Sunlit zone — Low / medium · no exploitation signal
impact 35.8 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to 7.15.2 and 8.10.2, AOR report generation reloads the value stored in aor_fields.field and concatenates it into report SQL without strict field validation. An authenticated user able to configure reports can inject SQL through that stored field value and disclose database contents. This issue is fixed in versions 7.15.2 and 8.10.2.
SuiteCRM < 7.15.2SuiteCRM >= 8.0.0, < 8.10.2Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-97377High· 8.8SuiteCRM: Authenticated SQL Injection in SOAP Portal Method portal_get_entry_list
CVE-2026-69141High· 8.3SuiteCRM: SQL injection via search param in modules/Cases/controller.php
CVE-2026-69135High· 7.1SuiteCRM: Authenticated SQL Injection In Project Module
CVE-2026-100365High· 8.8SuiteCRM: Time-Based Blind SQL Injection via AOR_Reports ORDER BY Clause Allows Data Exfiltration by Any Authenticated User
CVE-2026-100359Medium· 6.5SuiteCRM: Authenticated SQL Injection In action_get_end_date function
CVE-2026-69140High· 8.3SuiteCRM: SQL injection via get_latest_for_id param in GetLatestRevision.php