Vulnerabilidades
Resumen — últimos 7 días
Vulnerabilidades nuevas2980▼ 83 respecto a la semana anterior
Críticas / altas1452▲ 101 respecto a la semana anterior
Nueva explotación activa (KEV)4▼ 5 respecto a la semana anterior
Sin puntuar (sin CVSS)353▼ 157 respecto a la semana anterior
71 resultados, ordenados por fecha de publicación (más recientes primero)
| CVE | Estado | Severidad | EPSS | Explotación activa | Tecnologías afectadas | Publicada ▼ | Modificada | Descripción |
|---|---|---|---|---|---|---|---|---|
| Modificada | Alta (7.2) | 1.4% | — | Sugarcrm | 7/10/2019 | 17/6/2026 | SugarCRM before 8.0.4 and 9.x before 9.0.2 allows PHP code injection in the Configurator module by an Admin user. | |
| Modificada | Alta (8.8) | 1.4% | — | Sugarcrm | 7/10/2019 | 17/6/2026 | SugarCRM before 8.0.4 and 9.x before 9.0.2 allows PHP code injection in the MergeRecords module by a Regular user. | |
| Modificada | Alta (7.2) | 1.4% | — | Sugarcrm | 7/10/2019 | 17/6/2026 | SugarCRM before 8.0.4 and 9.x before 9.0.2 allows PHP code injection in the MergeRecords module by an Admin user. | |
| Modificada | Alta (8.8) | 1.4% | — | Sugarcrm | 7/10/2019 | 17/6/2026 | SugarCRM before 8.0.4 and 9.x before 9.0.2 allows PHP code injection in the MergeRecords module by a Developer user. | |
| Modificada | Alta (8.8) | 1.4% | — | Sugarcrm | 7/10/2019 | 17/6/2026 | SugarCRM before 8.0.4 and 9.x before 9.0.2 allows PHP code injection in the ModuleBuilder module by a Developer user. | |
| Modificada | Alta (7.2) | 1.4% | — | Sugarcrm | 7/10/2019 | 17/6/2026 | SugarCRM before 8.0.4 and 9.x before 9.0.2 allows PHP code injection in the ModuleBuilder module by an Admin user. | |
| Modificada | Alta (8.8) | 1.4% | — | Sugarcrm | 7/10/2019 | 17/6/2026 | SugarCRM before 8.0.4 and 9.x before 9.0.2 allows PHP code injection in the Administration module by a Developer user. | |
| Modificada | Alta (7.2) | 1.4% | — | Sugarcrm | 7/10/2019 | 17/6/2026 | SugarCRM before 8.0.4 and 9.x before 9.0.2 allows PHP code injection in the Administration module by an Admin user. | |
| Modificada | Alta (8.8) | 1.2% | — | Sugarcrm | 7/10/2019 | 17/6/2026 | SugarCRM before 8.0.4 and 9.x before 9.0.2 allows SQL injection in the Administration module by a Developer user. | |
| Modificada | Alta (8.8) | 1.2% | — | Sugarcrm | 7/10/2019 | 17/6/2026 | SugarCRM before 8.0.4 and 9.x before 9.0.2 allows SQL injection in the Quotes module by a Regular user. | |
| Modificada | Alta (8.8) | 1.2% | — | Sugarcrm | 7/10/2019 | 17/6/2026 | SugarCRM before 8.0.4 and 9.x before 9.0.2 allows SQL injection in the Contacts module by a Regular user. | |
| Modificada | Alta (8.8) | 1.2% | — | Sugarcrm | 7/10/2019 | 17/6/2026 | SugarCRM before 8.0.4 and 9.x before 9.0.2 allows SQL injection in the history function by a Regular user. | |
| Modificada | Alta (8.8) | 1.2% | — | Sugarcrm | 7/10/2019 | 17/6/2026 | SugarCRM before 8.0.4 and 9.x before 9.0.2 allows SQL injection in the export function by a Regular user. | |
| Modificada | Alta (8.8) | 1.2% | — | Sugarcrm | 7/10/2019 | 17/6/2026 | SugarCRM before 8.0.4 and 9.x before 9.0.2 allows SQL injection in the pmse_Project module by a Regular user. | |
| Modificada | Alta (7.2) | 1.1% | — | Sugarcrm | 7/10/2019 | 17/6/2026 | SugarCRM before 8.0.4 and 9.x before 9.0.2 allows SQL injection in the pmse_Inbox module by an Admin user. | |
| Modificada | Alta (8.8) | 1.2% | — | Sugarcrm | 7/10/2019 | 17/6/2026 | SugarCRM before 8.0.4 and 9.x before 9.0.2 allows SQL injection in the Emails module by a Regular user. | |
| Modificada | Alta (8.8) | 1.2% | — | Sugarcrm | 7/10/2019 | 17/6/2026 | SugarCRM before 8.0.4 and 9.x before 9.0.2 allows SQL injection in the pmse_Inbox module by a Regular user. | |
| Modificada | Alta (7.2) | 1.4% | — | Sugarcrm | 7/10/2019 | 17/6/2026 | SugarCRM before 8.0.4 and 9.x before 9.0.2 allows PHP object injection in the UpgradeWizard module by an Admin user. | |
| Modificada | Alta (8.8) | 1.5% | — | Sugarcrm | 7/10/2019 | 17/6/2026 | SugarCRM before 8.0.4 and 9.x before 9.0.2 allows PHP object injection in the Import module by a Regular user. | |
| Modificada | Alta (7.2) | 1.4% | — | Sugarcrm | 7/10/2019 | 17/6/2026 | SugarCRM before 8.0.4 and 9.x before 9.0.2 allows PHP object injection in the Administration module by an Admin user. | |
| Modificada | Media (6.1) | 28% | 💥 Exploit | Sugarcrm | 14/8/2019 | 17/6/2026 | SugarCRM Enterprise 9.0.0 allows mobile/error-not-supported-platform.html?desktop_url= XSS. | |
| Modificada | Media (6.1) | 4.4% | 💥 Exploit | Sugarcrm | 10/10/2018 | 17/6/2026 | Multiple vulnerabilities in YUI and FlashCanvas embedded in SugarCRM Community Edition 6.5.26 could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack on a targeted system. | |
| Modificada | Crítica (9.8) | 5.0% | — | Sugarcrm | 1/2/2018 | 17/6/2026 | XML external entity (XXE) vulnerability in the RSSDashlet dashlet in SugarCRM before 6.5.17 allows remote attackers to read arbitrary files or potentially execute arbitrary code via a crafted DTD in an XML request. | |
| Modificada | Crítica (9.8) | 1.1% | — | Sugarcrm | 25/1/2018 | 17/6/2026 | Multiple SQL injections exist in SugarCRM Community Edition 6.5.26 and below via the track parameter to modules\Campaigns\Tracker.php and modules\Campaigns\utils.php, the default_currency_name parameter to modules\Configurator\controller.php and modules\Currencies\Currency.php, the duplicate parameter to… | |
| Modificada | Media (6.1) | 6.9% | 💥 Exploit | Sugarcrm | 16/1/2018 | 17/6/2026 | phprint.php in SugarCRM 3.5.1 has XSS via a parameter name in the query string (aka a $key variable). |