Dashboard / CVE-2026-100359

CVE-2026-100359

MEDIUM
MEDIUM Priority: 0.02 BB Relevance: 63/100
Published: 2026-11-05 Modified: 2026-11-10 First seen: 2026-11-05 Status: active

Attack Surface

Network Low Complexity No Interaction Conf. Impact

CVSS Vector Breakdown

AV: Network
AC: Low
PR: Low
UI: None
S: Unchanged
C: High
I: None
A: None

Description

SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to 7.15.2 and 8.10.2, the Project Template module's action_get_end_date function interpolates authenticated caller-controlled task_id and lag POST parameters directly into SQL without sanitization, parameterization, or escaping. Any authenticated user can perform blind SQL injection to read customer data, internal communications, credentials, and other database contents. This issue is fixed in versions 7.15.2 and 8.10.2.

Weakness Classification (1)

Affected Software (5)

VendorProductVersion
SuiteCRM SuiteCRM < 7.15.2
SuiteCRM SuiteCRM >= 8.0.0, < 8.10.2
SuiteCRM SuiteCRM < 7.15.2
SuiteCRM SuiteCRM >= 8.0.0, < 8.10.2
suitecrm suitecrm < 7.15.2

References & Advisories (5)

Bug Bounty Relevance

63 / 100
✓ Network accessible
✓ Low complexity
✓ No user interaction

CVSS Score

6.5 / 10.0 v3.1
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

EPSS — Exploitation Probability

0.29%
Raw Score 0.002950
Percentile 22.5%
Date 2026-11-14

EPSS Trend

2026-11-14
0.00295
2026-11-13
0.00295
2026-11-12
0.00295
2026-11-10
0.00289
2026-11-09
0.00289
2026-11-08
0.00289
2026-11-07
0.00289
2026-11-06
0.00289

Intelligence Sources

mitre ref →
nvd ref →

External Links