Vulnerabilidades

Resumen — últimos 7 días

Vulnerabilidades nuevas2862▼ 326 respecto a la semana anterior

Críticas / altas1389▼ 28 respecto a la semana anterior

Nueva explotación activa (KEV)4▼ 5 respecto a la semana anterior

Sin puntuar (sin CVSS)293▼ 216 respecto a la semana anterior

124 resultados, ordenados por fecha de publicación (más recientes primero)

CVE	Estado	Severidad	EPSS	Explotación activa	Tecnologías afectadas	Publicada ▼	Modificada	Descripción
CVE-2020-8787	Modificada	Alta (7.5)	0.88%	—	Salesagility Suitecrm	16/3/2020	17/6/2026	SuiteCRM 7.10.x versions prior to 7.10.23 and 7.11.x versions prior to 7.11.11 allow for an invalid Bean ID to be submitted.
CVE-2020-8786	Modificada	Crítica (9.8)	1.1%	—	Salesagility Suitecrm	16/3/2020	17/6/2026	SuiteCRM 7.10.x versions prior to 7.10.23 and 7.11.x versions prior to 7.11.11 allow SQL Injection (issue 4 of 4).
CVE-2020-8785	Modificada	Crítica (9.8)	1.1%	—	Salesagility Suitecrm	16/3/2020	17/6/2026	SuiteCRM 7.10.x versions prior to 7.10.23 and 7.11.x versions prior to 7.11.11 allow SQL Injection (issue 3 of 4).
CVE-2020-8784	Modificada	Crítica (9.8)	1.1%	—	Salesagility Suitecrm	16/3/2020	17/6/2026	SuiteCRM 7.10.x versions prior to 7.10.23 and 7.11.x versions prior to 7.11.11 allow SQL Injection (issue 2 of 4).
CVE-2020-8783	Modificada	Crítica (9.8)	1.1%	—	Salesagility Suitecrm	16/3/2020	17/6/2026	SuiteCRM 7.10.x versions prior to 7.10.23 and 7.11.x versions prior to 7.11.11 allow SQL Injection (issue 1 of 4).
CVE-2020-8804	Modificada	Media (6.5)	1.4%	—	Salesagility Suitecrm	13/2/2020	17/6/2026	SuiteCRM through 7.11.10 allows SQL Injection via the SOAP API, the EmailUIAjax interface, or the MailMerge module.
CVE-2020-8803	Modificada	Crítica (9.8)	3.3%	—	Salesagility Suitecrm	13/2/2020	17/6/2026	SuiteCRM through 7.11.11 allows Directory Traversal to include arbitrary .php files within the webroot via add_to_prospect_list.
CVE-2020-8802	Modificada	Crítica (9.8)	2.6%	—	Salesagility Suitecrm	13/2/2020	17/6/2026	SuiteCRM through 7.11.11 has Incorrect Access Control via action_saveHTMLField Bean Manipulation.
CVE-2020-8801	Modificada	Alta (7.2)	2.8%	—	Salesagility Suitecrm	13/2/2020	17/6/2026	SuiteCRM through 7.11.11 allows PHAR Deserialization.
CVE-2020-8800	Modificada	Alta (8.8)	2.8%	—	Salesagility Suitecrm	13/2/2020	17/6/2026	SuiteCRM through 7.11.11 allows EmailsControllerActionGetFromFields PHP Object Injection.
CVE-2019-18784	Modificada	Crítica (9.8)	1.1%	—	Salesagility Suitecrm	6/11/2019	17/6/2026	SuiteCRM 7.10.x versions prior to 7.10.21 and 7.11.x versions prior to 7.11.9 allow SQL Injection.
CVE-2019-14454	Modificada	Crítica (9.8)	1.5%	—	Salesagility Suitecrm	2/10/2019	17/6/2026	SuiteCRM 7.11.x and 7.10.x before 7.11.8 and 7.10.20 is vulnerable to vertical privilege escalation.
CVE-2019-13335	Modificada	Crítica (9.8)	1.3%	—	Salesagility Suitecrm	2/10/2019	17/6/2026	SalesAgility SuiteCRM 7.10.x 7.10.19 and 7.11.x before and 7.11.7 has SSRF.
CVE-2019-14752	Modificada	Media (6.1)	0.65%	—	Salesagility Suitecrm	30/9/2019	17/6/2026	SuiteCRM 7.10.x and 7.11.x before 7.10.20 and 7.11.8 has XSS.
CVE-2019-16922	Modificada	Media (5.3)	1.1%	—	Salesagility Suitecrm	27/9/2019	17/6/2026	SuiteCRM 7.10.x before 7.10.20 and 7.11.x before 7.11.8 allows unintended public exposure of files.
CVE-2019-12601	Modificada	Crítica (9.8)	1.1%	—	Salesagility Suitecrm	7/6/2019	17/6/2026	SuiteCRM 7.8.x before 7.8.30, 7.10.x before 7.10.17, and 7.11.x before 7.11.5 allows SQL Injection (issue 3 of 3).
CVE-2019-12600	Modificada	Crítica (9.8)	1.1%	—	Salesagility Suitecrm	7/6/2019	17/6/2026	SuiteCRM 7.8.x before 7.8.30, 7.10.x before 7.10.17, and 7.11.x before 7.11.5 allows SQL Injection (issue 2 of 3).
CVE-2019-12599	Modificada	Crítica (9.8)	1.1%	—	Salesagility Suitecrm	7/6/2019	17/6/2026	SuiteCRM 7.10.x before 7.10.17 and 7.11.x before 7.11.5 allows SQL Injection.
CVE-2019-12598	Modificada	Crítica (9.8)	1.1%	—	Salesagility Suitecrm	7/6/2019	17/6/2026	SuiteCRM 7.8.x before 7.8.30, 7.10.x before 7.10.17, and 7.11.x before 7.11.5 allows SQL Injection (issue 1 of 3).
CVE-2018-20816	Modificada	Media (6.1)	0.57%	—	Salesagility Suitecrm	5/4/2019	17/6/2026	An XSS combined with CSRF vulnerability discovered in SalesAgility SuiteCRM 7.x before 7.8.24 and 7.10.x before 7.10.11 leads to cookie stealing, aka session hijacking. This issue affects the "add dashboard pages" feature where users can receive a malicious attack through a phished URL, with script executed.
CVE-2019-6506	Modificada	Crítica (9.8)	1.7%	—	Salesagility Suitecrm	2/4/2019	17/6/2026	SuiteCRM before 7.8.28, 7.9.x and 7.10.x before 7.10.15, and 7.11.x before 7.11.3 allows SQL Injection.
CVE-2018-15606	Modificada	Media (6.1)	0.65%	—	Salesagility Suitecrm	26/9/2018	17/6/2026	An XSS issue was discovered in SalesAgility SuiteCRM 7.x before 7.8.21 and 7.10.x before 7.10.8, related to phishing an error message.
CVE-2015-5948	Modificada	Alta (8.1)	4.5%	—	Salesagility Suitecrm	6/9/2017	17/6/2026	Race condition in SuiteCRM before 7.2.3 allows remote attackers to execute arbitrary code. NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-5947.
CVE-2015-5947	Modificada	Alta (8.1)	2.7%	—	Salesagility Suitecrm	6/9/2017	17/6/2026	SuiteCRM before 7.2.3 allows remote attackers to execute arbitrary code.