Skip to content

Sugarcrm · weakness class

SQL Injection

15 CVEs

Every dot is a CVE in what this vendor ships; the named ones are the most at risk.

Every one of the 15 is a mark on the map. Named now: 1 to 15, most at risk first.

  1. An issue was discovered in SugarCRM before 7.7.2.3, 7.8.x before 7.8.2.2, and 7.9.x before 7.9.2.0 (and Sugar Community Edition 6.5.26). Several areas have been identified in the…CVE-2017-14508Sugarcrm · 2.6% likely

    CWE-89

  2. Multiple SQL injection vulnerabilities in the Leads module in SugarCRM 6.1 before 6.1.7, 6.2 before 6.2.4, 6.3 before 6.3.0RC3, and 6.4 before 6.4.0beta1 allow remote attackers to…CVE-2011-4833Sugarcrm · 1.9% likely

    CWE-89

  3. SugarCRM before 10.1.0 (Q3 2020) allows SQL Injection.CVE-2020-17373Sugarcrm · 1.4% likely

    CWE-89

  4. SQL injection vulnerability in SugarCRM 4.5.1o and earlier, 5.0.0k and earlier, and 5.2.0g and earlier, allows remote attackers to execute arbitrary SQL commands via unspecified v…CVE-2009-2978Sugarcrm · 1.4% likely

    CWE-89

  5. SugarCRM before 8.0.4 and 9.x before 9.0.2 allows SQL injection in the Emails module by a Regular user.CVE-2019-17319Sugarcrm · 1.2% likely

    CWE-89

  6. SugarCRM before 8.0.4 and 9.x before 9.0.2 allows SQL injection in the pmse_Inbox module by a Regular user.CVE-2019-17318Sugarcrm · 1.2% likely

    CWE-89

  7. SugarCRM before 8.0.4 and 9.x before 9.0.2 allows SQL injection in the Administration module by a Developer user.CVE-2019-17298Sugarcrm · 1.2% likely

    CWE-89

  8. SugarCRM before 8.0.4 and 9.x before 9.0.2 allows SQL injection in the Quotes module by a Regular user.CVE-2019-17297Sugarcrm · 1.2% likely

    CWE-89

  9. SugarCRM before 8.0.4 and 9.x before 9.0.2 allows SQL injection in the Contacts module by a Regular user.CVE-2019-17296Sugarcrm · 1.2% likely

    CWE-89

  10. SugarCRM before 8.0.4 and 9.x before 9.0.2 allows SQL injection in the history function by a Regular user.CVE-2019-17295Sugarcrm · 1.2% likely

    CWE-89

  11. SugarCRM before 8.0.4 and 9.x before 9.0.2 allows SQL injection in the export function by a Regular user.CVE-2019-17294Sugarcrm · 1.2% likely

    CWE-89

  12. SugarCRM before 8.0.4 and 9.x before 9.0.2 allows SQL injection in the pmse_Project module by a Regular user.CVE-2019-17293Sugarcrm · 1.2% likely

    CWE-89

  13. SugarCRM before 8.0.4 and 9.x before 9.0.2 allows SQL injection in the pmse_Inbox module by an Admin user.CVE-2019-17292Sugarcrm · 1.1% likely

    CWE-89

  14. Multiple SQL injections exist in SugarCRM Community Edition 6.5.26 and below via the track parameter to modules\Campaigns\Tracker.php and modules\Campaigns\utils.php, the default_…CVE-2018-6308Sugarcrm · 1.1% likely

    CWE-89

  15. An issue was discovered in SugarCRM Enterprise before 11.0.6 and 12.x before 12.0.3. Two SQL Injection vectors have been identified in the REST API. By using crafted requests, cus…CVE-2023-35811Sugarcrm · 1.0% likely

    CWE-89

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.

Data as of 2026-11-15. CVE List through 2026-11-15 · EPSS of 2026-11-14 · CISA KEV checked 2026-11-15. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data.