{"schema_version":1,"title":"SuiteCRM vulnerabilities","summary":"Junglewise Threat Intelligence has tracked 33 vulnerabilities in SuiteCRM: 0 in the last 7 days and 33 in the last 90 days, 1 of them critical and 0 exploited in the wild. The most recent, CVE-2026-97377, was published on 5 November 2026. 31 vulnerabilities in the last four weeks, up 1450% on the four before (2). 1 critical against 0. 1 technology has a page of its own.","url":"https://junglewise.ai/threats/vendors/suitecrm","json_url":"https://junglewise.ai/threats/vendors/suitecrm.json","publisher":"Junglewise Threat Intelligence","license":"CC-BY-4.0","license_url":"https://creativecommons.org/licenses/by/4.0/","attribution":"Junglewise Threat Intelligence, https://junglewise.ai/threats/vendors/suitecrm","sources":"NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories","kind":"vendor","thin":false,"counts":{"high":21,"all_time":33,"critical":1,"exploited":0,"last_7_days":0,"last_30_days":31,"last_90_days":33,"last_365_days":33},"latest":[{"cve":"CVE-2026-97377","cvss":8.8,"slug":"cve-2026-97377-suitecrm-is-an-open-source-enterprise-ready-customer-relationship","title":"SuiteCRM SQL injection in SOAP portal API","severity":"high","exploited":false,"published_at":"2026-11-05T19:17:29.28+00:00","url":"https://junglewise.ai/threats/cve-2026-97377-suitecrm-is-an-open-source-enterprise-ready-customer-relationship"},{"cve":"CVE-2026-71550","cvss":9.9,"slug":"cve-2026-71550-suitecrm-is-an-open-source-enterprise-ready-customer-relationship","title":"SuiteCRM path traversal in workflow controller","severity":"critical","exploited":false,"published_at":"2026-11-05T19:17:26.357+00:00","url":"https://junglewise.ai/threats/cve-2026-71550-suitecrm-is-an-open-source-enterprise-ready-customer-relationship"},{"cve":"CVE-2026-71548","cvss":8.8,"slug":"cve-2026-71548-suitecrm-is-an-open-source-enterprise-ready-customer-relationship","title":"SuiteCRM SQL injection in report query builder","severity":"high","exploited":false,"published_at":"2026-11-05T19:17:26.183+00:00","url":"https://junglewise.ai/threats/cve-2026-71548-suitecrm-is-an-open-source-enterprise-ready-customer-relationship"},{"cve":"CVE-2026-69145","cvss":6.5,"slug":"cve-2026-69145-suitecrm-is-an-open-source-enterprise-ready-customer-relationship","title":"SuiteCRM SQL injection in AOR report generation","severity":"medium","exploited":false,"published_at":"2026-11-05T19:17:26.013+00:00","url":"https://junglewise.ai/threats/cve-2026-69145-suitecrm-is-an-open-source-enterprise-ready-customer-relationship"},{"cve":"CVE-2026-69144","cvss":6.5,"slug":"cve-2026-69144-suitecrm-is-an-open-source-enterprise-ready-customer-relationship","title":"SuiteCRM download authorization bypass in document access","severity":"medium","exploited":false,"published_at":"2026-11-05T19:17:25.83+00:00","url":"https://junglewise.ai/threats/cve-2026-69144-suitecrm-is-an-open-source-enterprise-ready-customer-relationship"},{"cve":"CVE-2026-69142","cvss":8.8,"slug":"cve-2026-69142-suitecrm-is-an-open-source-enterprise-ready-customer-relationship","title":"SuiteCRM SQL injection in jjwg_Maps endpoint","severity":"high","exploited":false,"published_at":"2026-11-05T19:17:25.66+00:00","url":"https://junglewise.ai/threats/cve-2026-69142-suitecrm-is-an-open-source-enterprise-ready-customer-relationship"},{"cve":"CVE-2026-69141","cvss":8.3,"slug":"cve-2026-69141-suitecrm-is-an-open-source-enterprise-ready-customer-relationship","title":"SuiteCRM Cases controller SQL injection via unfiltered POST parameter","severity":"high","exploited":false,"published_at":"2026-11-05T19:17:25.49+00:00","url":"https://junglewise.ai/threats/cve-2026-69141-suitecrm-is-an-open-source-enterprise-ready-customer-relationship"},{"cve":"CVE-2026-69140","cvss":8.3,"slug":"cve-2026-69140-suitecrm-is-an-open-source-enterprise-ready-customer-relationship","title":"SuiteCRM SQL injection in GetLatestRevision.php","severity":"high","exploited":false,"published_at":"2026-11-05T19:17:25.313+00:00","url":"https://junglewise.ai/threats/cve-2026-69140-suitecrm-is-an-open-source-enterprise-ready-customer-relationship"},{"cve":"CVE-2026-69137","cvss":7.7,"slug":"cve-2026-69137-suitecrm-is-an-open-source-enterprise-ready-customer-relationship","title":"SuiteCRM server-url validation bypass in CalendarAccount","severity":"high","exploited":false,"published_at":"2026-11-05T19:17:25.147+00:00","url":"https://junglewise.ai/threats/cve-2026-69137-suitecrm-is-an-open-source-enterprise-ready-customer-relationship"},{"cve":"CVE-2026-69136","cvss":7.1,"slug":"cve-2026-69136-suitecrm-is-an-open-source-enterprise-ready-customer-relationship","title":"SuiteCRM SQL injection in email template attachment handling","severity":"high","exploited":false,"published_at":"2026-11-05T19:17:24.977+00:00","url":"https://junglewise.ai/threats/cve-2026-69136-suitecrm-is-an-open-source-enterprise-ready-customer-relationship"},{"cve":"CVE-2026-69135","cvss":7.1,"slug":"cve-2026-69135-suitecrm-is-an-open-source-enterprise-ready-customer-relationship","title":"SuiteCRM Project module SQL injection","severity":"high","exploited":false,"published_at":"2026-11-05T19:17:24.753+00:00","url":"https://junglewise.ai/threats/cve-2026-69135-suitecrm-is-an-open-source-enterprise-ready-customer-relationship"},{"cve":"CVE-2026-69134","cvss":8.8,"slug":"cve-2026-69134-suitecrm-is-an-open-source-enterprise-ready-customer-relationship","title":"SuiteCRM SQL injection in REST v4 relationship write helpers","severity":"high","exploited":false,"published_at":"2026-11-05T19:17:24.533+00:00","url":"https://junglewise.ai/threats/cve-2026-69134-suitecrm-is-an-open-source-enterprise-ready-customer-relationship"},{"cve":"CVE-2026-63218","cvss":6.5,"slug":"cve-2026-63218-suitecrm-is-an-open-source-enterprise-ready-customer-relationship","title":"SuiteCRM access control bypass in report viewing","severity":"medium","exploited":false,"published_at":"2026-11-05T19:17:24.173+00:00","url":"https://junglewise.ai/threats/cve-2026-63218-suitecrm-is-an-open-source-enterprise-ready-customer-relationship"},{"cve":"CVE-2026-63217","cvss":6.5,"slug":"cve-2026-63217-suitecrm-is-an-open-source-enterprise-ready-customer-relationship","title":"SuiteCRM PDF generation unauthorized data access","severity":"medium","exploited":false,"published_at":"2026-11-05T19:17:23.957+00:00","url":"https://junglewise.ai/threats/cve-2026-63217-suitecrm-is-an-open-source-enterprise-ready-customer-relationship"},{"cve":"CVE-2026-63215","cvss":8.3,"slug":"cve-2026-63215-suitecrm-is-an-open-source-enterprise-ready-customer-relationship","title":"SuiteCRM REST API SQL injection in get_entry_list","severity":"high","exploited":false,"published_at":"2026-11-05T19:17:23.75+00:00","url":"https://junglewise.ai/threats/cve-2026-63215-suitecrm-is-an-open-source-enterprise-ready-customer-relationship"},{"cve":"CVE-2026-63214","cvss":8.8,"slug":"cve-2026-63214-suitecrm-is-an-open-source-enterprise-ready-customer-relationship","title":"SuiteCRM SQL injection in REST API query methods","severity":"high","exploited":false,"published_at":"2026-11-05T19:17:23.557+00:00","url":"https://junglewise.ai/threats/cve-2026-63214-suitecrm-is-an-open-source-enterprise-ready-customer-relationship"},{"cve":"CVE-2026-63213","cvss":7.2,"slug":"cve-2026-63213-suitecrm-is-an-open-source-enterprise-ready-customer-relationship","title":"SuiteCRM Upgrade Wizard path traversal in zip extraction","severity":"high","exploited":false,"published_at":"2026-11-05T19:17:23.333+00:00","url":"https://junglewise.ai/threats/cve-2026-63213-suitecrm-is-an-open-source-enterprise-ready-customer-relationship"},{"cve":"CVE-2026-63111","slug":"cve-2026-63111-suitecrm-is-an-open-source-enterprise-ready-customer-relationship","title":"SuiteCRM authorization bypass in V8 API SchedulersJobs","severity":"info","exploited":false,"published_at":"2026-11-05T19:17:23.137+00:00","url":"https://junglewise.ai/threats/cve-2026-63111-suitecrm-is-an-open-source-enterprise-ready-customer-relationship"},{"cve":"CVE-2026-61653","cvss":8.3,"slug":"cve-2026-61653-suitecrm-is-an-open-source-enterprise-ready-customer-relationship","title":"SuiteCRM Campaigns SQL injection in PopupCampaignRoi","severity":"high","exploited":false,"published_at":"2026-11-05T19:17:22.937+00:00","url":"https://junglewise.ai/threats/cve-2026-61653-suitecrm-is-an-open-source-enterprise-ready-customer-relationship"},{"cve":"CVE-2026-61651","cvss":8.3,"slug":"cve-2026-61651-suitecrm-is-an-open-source-enterprise-ready-customer-relationship","title":"SuiteCRM SQL injection in Projects Controller","severity":"high","exploited":false,"published_at":"2026-11-05T19:17:22.737+00:00","url":"https://junglewise.ai/threats/cve-2026-61651-suitecrm-is-an-open-source-enterprise-ready-customer-relationship"},{"cve":"CVE-2026-61650","cvss":8.1,"slug":"cve-2026-61650-suitecrm-is-an-open-source-enterprise-ready-customer-relationship","title":"SuiteCRM authorization bypass in relationship endpoint","severity":"high","exploited":false,"published_at":"2026-11-05T19:17:22.55+00:00","url":"https://junglewise.ai/threats/cve-2026-61650-suitecrm-is-an-open-source-enterprise-ready-customer-relationship"},{"cve":"CVE-2026-61649","cvss":7.7,"slug":"cve-2026-61649-suitecrm-is-an-open-source-enterprise-ready-customer-relationship","title":"SuiteCRM server-side request forgery via hostname bypass","severity":"high","exploited":false,"published_at":"2026-11-05T19:17:22.38+00:00","url":"https://junglewise.ai/threats/cve-2026-61649-suitecrm-is-an-open-source-enterprise-ready-customer-relationship"},{"cve":"CVE-2026-61648","cvss":8.3,"slug":"cve-2026-61648-suitecrm-is-an-open-source-enterprise-ready-customer-relationship","title":"SuiteCRM SQL injection in AOR Reports","severity":"high","exploited":false,"published_at":"2026-11-05T19:17:22.203+00:00","url":"https://junglewise.ai/threats/cve-2026-61648-suitecrm-is-an-open-source-enterprise-ready-customer-relationship"},{"cve":"CVE-2026-100365","cvss":8.8,"slug":"cve-2026-100365-suitecrm-is-an-open-source-enterprise-ready-customer","title":"SuiteCRM AOR report SQL injection via field label","severity":"high","exploited":false,"published_at":"2026-11-05T19:16:59.133+00:00","url":"https://junglewise.ai/threats/cve-2026-100365-suitecrm-is-an-open-source-enterprise-ready-customer"},{"cve":"CVE-2026-100364","cvss":7.1,"slug":"cve-2026-100364-suitecrm-is-an-open-source-enterprise-ready-customer","title":"SuiteCRM JSON:API authorization bypass in record update","severity":"high","exploited":false,"published_at":"2026-11-05T19:16:58.647+00:00","url":"https://junglewise.ai/threats/cve-2026-100364-suitecrm-is-an-open-source-enterprise-ready-customer"}],"vendor":{"hub":true,"name":"SuiteCRM","slug":"suitecrm","description":"Customer relationship management and enterprise resource planning software suite.","url":"https://junglewise.ai/threats/vendors/suitecrm"},"weekly":[{"week":"2026-08-17","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-24","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-31","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-07","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-14","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-21","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-28","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-10-05","critical":0,"exploited":0,"vulnerabilities":2},{"week":"2026-10-12","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-10-19","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-10-26","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-11-02","critical":1,"exploited":0,"vulnerabilities":31},{"week":"2026-11-09","critical":0,"exploited":0,"vulnerabilities":0}],"most_severe":[{"cve":"CVE-2026-71550","cvss":9.9,"slug":"cve-2026-71550-suitecrm-is-an-open-source-enterprise-ready-customer-relationship","title":"SuiteCRM path traversal in workflow controller","severity":"critical","exploited":false,"published_at":"2026-11-05T19:17:26.357+00:00","url":"https://junglewise.ai/threats/cve-2026-71550-suitecrm-is-an-open-source-enterprise-ready-customer-relationship"},{"cve":"CVE-2026-97377","cvss":8.8,"slug":"cve-2026-97377-suitecrm-is-an-open-source-enterprise-ready-customer-relationship","title":"SuiteCRM SQL injection in SOAP portal API","severity":"high","exploited":false,"published_at":"2026-11-05T19:17:29.28+00:00","url":"https://junglewise.ai/threats/cve-2026-97377-suitecrm-is-an-open-source-enterprise-ready-customer-relationship"},{"cve":"CVE-2026-71548","cvss":8.8,"slug":"cve-2026-71548-suitecrm-is-an-open-source-enterprise-ready-customer-relationship","title":"SuiteCRM SQL injection in report query builder","severity":"high","exploited":false,"published_at":"2026-11-05T19:17:26.183+00:00","url":"https://junglewise.ai/threats/cve-2026-71548-suitecrm-is-an-open-source-enterprise-ready-customer-relationship"},{"cve":"CVE-2026-69142","cvss":8.8,"slug":"cve-2026-69142-suitecrm-is-an-open-source-enterprise-ready-customer-relationship","title":"SuiteCRM SQL injection in jjwg_Maps endpoint","severity":"high","exploited":false,"published_at":"2026-11-05T19:17:25.66+00:00","url":"https://junglewise.ai/threats/cve-2026-69142-suitecrm-is-an-open-source-enterprise-ready-customer-relationship"},{"cve":"CVE-2026-69134","cvss":8.8,"slug":"cve-2026-69134-suitecrm-is-an-open-source-enterprise-ready-customer-relationship","title":"SuiteCRM SQL injection in REST v4 relationship write helpers","severity":"high","exploited":false,"published_at":"2026-11-05T19:17:24.533+00:00","url":"https://junglewise.ai/threats/cve-2026-69134-suitecrm-is-an-open-source-enterprise-ready-customer-relationship"},{"cve":"CVE-2026-63214","cvss":8.8,"slug":"cve-2026-63214-suitecrm-is-an-open-source-enterprise-ready-customer-relationship","title":"SuiteCRM SQL injection in REST API query methods","severity":"high","exploited":false,"published_at":"2026-11-05T19:17:23.557+00:00","url":"https://junglewise.ai/threats/cve-2026-63214-suitecrm-is-an-open-source-enterprise-ready-customer-relationship"},{"cve":"CVE-2026-100365","cvss":8.8,"slug":"cve-2026-100365-suitecrm-is-an-open-source-enterprise-ready-customer","title":"SuiteCRM AOR report SQL injection via field label","severity":"high","exploited":false,"published_at":"2026-11-05T19:16:59.133+00:00","url":"https://junglewise.ai/threats/cve-2026-100365-suitecrm-is-an-open-source-enterprise-ready-customer"},{"cve":"CVE-2026-100363","cvss":8.8,"slug":"cve-2026-100363-suitecrm-is-an-open-source-enterprise-ready-customer","title":"SuiteCRM API privilege escalation via OAuth2 authentication","severity":"high","exploited":false,"published_at":"2026-11-05T19:16:58.207+00:00","url":"https://junglewise.ai/threats/cve-2026-100363-suitecrm-is-an-open-source-enterprise-ready-customer"},{"cve":"CVE-2026-69141","cvss":8.3,"slug":"cve-2026-69141-suitecrm-is-an-open-source-enterprise-ready-customer-relationship","title":"SuiteCRM Cases controller SQL injection via unfiltered POST parameter","severity":"high","exploited":false,"published_at":"2026-11-05T19:17:25.49+00:00","url":"https://junglewise.ai/threats/cve-2026-69141-suitecrm-is-an-open-source-enterprise-ready-customer-relationship"},{"cve":"CVE-2026-69140","cvss":8.3,"slug":"cve-2026-69140-suitecrm-is-an-open-source-enterprise-ready-customer-relationship","title":"SuiteCRM SQL injection in GetLatestRevision.php","severity":"high","exploited":false,"published_at":"2026-11-05T19:17:25.313+00:00","url":"https://junglewise.ai/threats/cve-2026-69140-suitecrm-is-an-open-source-enterprise-ready-customer-relationship"}],"generated_at":"2026-11-13T03:07:00.155039+00:00","technologies":[{"name":"SuiteCRM","slug":"suitecrm-suitecrm","vulnerabilities":33,"url":"https://junglewise.ai/threats/technologies/suitecrm-suitecrm"}]}