SugarCRM vulnerabilities

CVEs whose affected-version data names the SugarCRM package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.

1 CVERSS

CVE-2025-25034Critical· 9.3PoC

1y ago

SugarCRM PHP Deserialization RCE

A PHP object injection vulnerability exists in SugarCRM versions prior to 6.5.24, 6.7.13, 7.5.2.5, 7.6.2.2, and 7.7.1.0 due to improper validation of PHP serialized input in the SugarRestSerialize.php script. The vulnerable code fails to…

▾ AbyssalSugarCRM · SugarCRMEPSS 5.0%via CVEORG