Technology · SuiteCRM
SuiteCRM vulnerabilities
Updated . Rebuilt every hour.
Junglewise Threat Intelligence has tracked 33 vulnerabilities in SuiteCRM: 0 in the last 7 days and 33 in the last 90 days, 1 of them critical and 0 exploited in the wild. The most recent, CVE-2026-97377, was published on 5 November 2026. 31 vulnerabilities in the last four weeks, up 1450% on the four before (2). 1 critical against 0.
- Last 7 days
- 0
- Last 90 days
- 33
- Critical, all time
- 1
- Exploited in the wild
- 0
About SuiteCRM
Open-source customer relationship management system for business operations.
Latest SuiteCRM vulnerabilities
- CVE-2026-97377: SuiteCRM SQL injection in SOAP portal APIhighCVSS 8.8
- CVE-2026-71550: SuiteCRM path traversal in workflow controllercriticalCVSS 9.9
- CVE-2026-71548: SuiteCRM SQL injection in report query builderhighCVSS 8.8
- CVE-2026-69145: SuiteCRM SQL injection in AOR report generationmediumCVSS 6.5
- CVE-2026-69144: SuiteCRM download authorization bypass in document accessmediumCVSS 6.5
- CVE-2026-69142: SuiteCRM SQL injection in jjwg_Maps endpointhighCVSS 8.8
- CVE-2026-69141: SuiteCRM Cases controller SQL injection via unfiltered POST parameterhighCVSS 8.3
- CVE-2026-69140: SuiteCRM SQL injection in GetLatestRevision.phphighCVSS 8.3
- CVE-2026-69137: SuiteCRM server-url validation bypass in CalendarAccounthighCVSS 7.7
- CVE-2026-69136: SuiteCRM SQL injection in email template attachment handlinghighCVSS 7.1
- CVE-2026-69135: SuiteCRM Project module SQL injectionhighCVSS 7.1
- CVE-2026-69134: SuiteCRM SQL injection in REST v4 relationship write helpershighCVSS 8.8
- CVE-2026-63218: SuiteCRM access control bypass in report viewingmediumCVSS 6.5
- CVE-2026-63217: SuiteCRM PDF generation unauthorized data accessmediumCVSS 6.5
- CVE-2026-63215: SuiteCRM REST API SQL injection in get_entry_listhighCVSS 8.3
- CVE-2026-63214: SuiteCRM SQL injection in REST API query methodshighCVSS 8.8
- CVE-2026-63213: SuiteCRM Upgrade Wizard path traversal in zip extractionhighCVSS 7.2
- CVE-2026-63111: SuiteCRM authorization bypass in V8 API SchedulersJobsinfo
- CVE-2026-61653: SuiteCRM Campaigns SQL injection in PopupCampaignRoihighCVSS 8.3
- CVE-2026-61651: SuiteCRM SQL injection in Projects ControllerhighCVSS 8.3
- CVE-2026-61650: SuiteCRM authorization bypass in relationship endpointhighCVSS 8.1
- CVE-2026-61649: SuiteCRM server-side request forgery via hostname bypasshighCVSS 7.7
- CVE-2026-61648: SuiteCRM SQL injection in AOR ReportshighCVSS 8.3
- CVE-2026-100365: SuiteCRM AOR report SQL injection via field labelhighCVSS 8.8
- CVE-2026-100364: SuiteCRM JSON:API authorization bypass in record updatehighCVSS 7.1
Most severe SuiteCRM vulnerabilities
Exploited in the wild first, then by severity and CVSS score.
- CVE-2026-71550: SuiteCRM path traversal in workflow controllercriticalCVSS 9.9
- CVE-2026-97377: SuiteCRM SQL injection in SOAP portal APIhighCVSS 8.8
- CVE-2026-71548: SuiteCRM SQL injection in report query builderhighCVSS 8.8
- CVE-2026-69142: SuiteCRM SQL injection in jjwg_Maps endpointhighCVSS 8.8
- CVE-2026-69134: SuiteCRM SQL injection in REST v4 relationship write helpershighCVSS 8.8
- CVE-2026-63214: SuiteCRM SQL injection in REST API query methodshighCVSS 8.8
- CVE-2026-100365: SuiteCRM AOR report SQL injection via field labelhighCVSS 8.8
- CVE-2026-100363: SuiteCRM API privilege escalation via OAuth2 authenticationhighCVSS 8.8
- CVE-2026-69141: SuiteCRM Cases controller SQL injection via unfiltered POST parameterhighCVSS 8.3
- CVE-2026-69140: SuiteCRM SQL injection in GetLatestRevision.phphighCVSS 8.3
Vulnerabilities per week
31 vulnerabilities in the last four weeks, up 1450% on the four before (2). 1 critical against 0. The last 13 weeks, by the week each vulnerability was published.
| Week of | Bar | Vulns | Critical |
|---|---|---|---|
| 17 Aug 2026 | 0 | 0 | |
| 24 Aug 2026 | 0 | 0 | |
| 31 Aug 2026 | 0 | 0 | |
| 7 Sep 2026 | 0 | 0 | |
| 14 Sep 2026 | 0 | 0 | |
| 21 Sep 2026 | 0 | 0 | |
| 28 Sep 2026 | 0 | 0 | |
| 5 Oct 2026 | 2 | 0 | |
| 12 Oct 2026 | 0 | 0 | |
| 19 Oct 2026 | 0 | 0 | |
| 26 Oct 2026 | 0 | 0 | |
| 2 Nov 2026 | 31 | 1 | |
| 9 Nov 2026 | 0 | 0 |
Embed a badge
A live badge for a README, a status page or an internal wiki: how many SuiteCRM vulnerabilities were published in the last 7 days and how many of them are critical, refreshed hourly.
[](https://junglewise.ai/threats/technologies/suitecrm-suitecrm)<a href="https://junglewise.ai/threats/technologies/suitecrm-suitecrm"><img src="https://junglewise.ai/threats/technologies/suitecrm-suitecrm/badge.svg" alt="SuiteCRM vulnerabilities" /></a>How this is built
Junglewise Threat Intelligence collects vulnerabilities from NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories, and matches each one to the technologies and vendors it affects. Dates are the date a vulnerability was published, in UTC.
The pages are rebuilt from the database every hour. Frozen weekly and monthly reports never change once published, so they can be cited.
Use this data
The same data is at https://junglewise.ai/threats/technologies/suitecrm-suitecrm.json, and this page as text at https://junglewise.ai/threats/technologies/suitecrm-suitecrm.md, for scripts and language models. It is free to reuse under CC BY 4.0 with a link back to this page.
Cite as: Junglewise Threat Intelligence, "SuiteCRM vulnerabilities", https://junglewise.ai/threats/technologies/suitecrm-suitecrm, 13 November 2026.